cb2d0893a940cead9d3c749dfa6e3440d7b55abe16dc89706007a02578de8464 | Triage

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 18:24

Sharing

Report Analysis Logs

General

Target

cb2d0893a940cead9d3c749dfa6e3440d7b55abe16dc89706007a02578de8464.dll
Size

3KB
MD5

fecc6b1ff973551d5e52d6b6bea7e1a5
SHA1

2cd1a1573da84c48e9906cba9a63d4d4b6c856b2
SHA256

cb2d0893a940cead9d3c749dfa6e3440d7b55abe16dc89706007a02578de8464
SHA512

27f81b53467bb5823eb4109b0722c2ebc67eef377078e5168a3bf0eb194fcfea96bbef1e43b3f9169b8a226fb4d37eccfa3d4eeb0165a856ee93530316d7686b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1516	1708	rundll32.exe	27
PID 1708 wrote to memory of 1516	1708	rundll32.exe	27
PID 1708 wrote to memory of 1516	1708	rundll32.exe	27
PID 1708 wrote to memory of 1516	1708	rundll32.exe	27
PID 1708 wrote to memory of 1516	1708	rundll32.exe	27
PID 1708 wrote to memory of 1516	1708	rundll32.exe	27
PID 1708 wrote to memory of 1516	1708	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb2d0893a940cead9d3c749dfa6e3440d7b55abe16dc89706007a02578de8464.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb2d0893a940cead9d3c749dfa6e3440d7b55abe16dc89706007a02578de8464.dll,#1
  2⤵
  PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-55-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download