b8859847b25a3cec7bb97b7cc8d32c5f1343a26c5eec31e2a189cb993e11e0a8 | Triage

Analysis

max time kernel
29s
max time network
84s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:51

Sharing

Report Analysis Logs

General

Target

b8859847b25a3cec7bb97b7cc8d32c5f1343a26c5eec31e2a189cb993e11e0a8.dll
Size

4KB
MD5

a5c4707c6c21f33930d8163b0a154240
SHA1

08ebd43849d6f93afd70f3b2b3468ce02fd37c7d
SHA256

b8859847b25a3cec7bb97b7cc8d32c5f1343a26c5eec31e2a189cb993e11e0a8
SHA512

b0882c34c25f98a9ec1a8431213e711abe621fea5308683be87faeadb1a58506d8a6b42615a4f29e4afa5574ab62a3d7a395a92676f7a3976b40026fedddeb1c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1076	1480	rundll32.exe	27
PID 1480 wrote to memory of 1076	1480	rundll32.exe	27
PID 1480 wrote to memory of 1076	1480	rundll32.exe	27
PID 1480 wrote to memory of 1076	1480	rundll32.exe	27
PID 1480 wrote to memory of 1076	1480	rundll32.exe	27
PID 1480 wrote to memory of 1076	1480	rundll32.exe	27
PID 1480 wrote to memory of 1076	1480	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8859847b25a3cec7bb97b7cc8d32c5f1343a26c5eec31e2a189cb993e11e0a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8859847b25a3cec7bb97b7cc8d32c5f1343a26c5eec31e2a189cb993e11e0a8.dll,#1
  2⤵
  PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download