7d60c63c939559b2ce92af0105fd65c4495924aec90e4db544159a20521dbdde | Triage

Analysis

max time kernel
180s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 10:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7d60c63c939559b2ce92af0105fd65c4495924aec90e4db544159a20521dbdde.dll
Size

4KB
MD5

5e5acf10e77dca202faccc3973ceab70
SHA1

667283eded3726e523bb314786d597305d8bb2dd
SHA256

7d60c63c939559b2ce92af0105fd65c4495924aec90e4db544159a20521dbdde
SHA512

a5b71f1f63d6951cd955e876e64e02b46f65e80248d713105f277d27beef2440761f511b2cddbba33dbbf6a85f45e0c05baf22c984b8d90efdcc189cd0c6d61f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 64	1324	rundll32.exe	67
PID 1324 wrote to memory of 64	1324	rundll32.exe	67
PID 1324 wrote to memory of 64	1324	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d60c63c939559b2ce92af0105fd65c4495924aec90e4db544159a20521dbdde.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d60c63c939559b2ce92af0105fd65c4495924aec90e4db544159a20521dbdde.dll,#1
  2⤵
  PID:64

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads