447e9022ba900c49a8cd05460376e80c42af3152878b9417736ad9f9ed7ae0ea | Triage

Analysis

max time kernel
48s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:56

Sharing

Report Analysis Logs

General

Target

447e9022ba900c49a8cd05460376e80c42af3152878b9417736ad9f9ed7ae0ea.dll
Size

4KB
MD5

8911e530f8bc6e32ed85a371e8a5ff50
SHA1

03c68e12a09aa493d23ec31dffed8ac1f931517a
SHA256

447e9022ba900c49a8cd05460376e80c42af3152878b9417736ad9f9ed7ae0ea
SHA512

0756e0e293564240fe59ee9934c583c523d2271cdfafd90370567159d82efb490d98e10cb40d27fae4066e41cb1117738649a139527d145109432d200a816137

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1260	1364	rundll32.exe	26
PID 1364 wrote to memory of 1260	1364	rundll32.exe	26
PID 1364 wrote to memory of 1260	1364	rundll32.exe	26
PID 1364 wrote to memory of 1260	1364	rundll32.exe	26
PID 1364 wrote to memory of 1260	1364	rundll32.exe	26
PID 1364 wrote to memory of 1260	1364	rundll32.exe	26
PID 1364 wrote to memory of 1260	1364	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\447e9022ba900c49a8cd05460376e80c42af3152878b9417736ad9f9ed7ae0ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\447e9022ba900c49a8cd05460376e80c42af3152878b9417736ad9f9ed7ae0ea.dll,#1
  2⤵
  PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download