7833c3ca67c2c2da90a0438dc141581cc3e468e62be89887c6f3b520f7912e01 | Triage

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7833c3ca67c2c2da90a0438dc141581cc3e468e62be89887c6f3b520f7912e01.dll
Size

4KB
MD5

ade84d3b98c2a1cfea5bf3d176697eb0
SHA1

8c3544a2f9f25277a4eec247259f719dcfc58632
SHA256

7833c3ca67c2c2da90a0438dc141581cc3e468e62be89887c6f3b520f7912e01
SHA512

e2da4655c3e7424301dc140e8563620564335cdda9e2bf0f94d2ceeb50ee6c32d049f86eda831643d87862a3ebc55e5d69a10eba00341ffa9bb7d98b45c75758

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28
PID 1632 wrote to memory of 1260	1632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7833c3ca67c2c2da90a0438dc141581cc3e468e62be89887c6f3b520f7912e01.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7833c3ca67c2c2da90a0438dc141581cc3e468e62be89887c6f3b520f7912e01.dll,#1
  2⤵
  PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download