b725f0bbe837d2e83a3f6001743714950de5390f9a2038025bc417c9300ce533 | Triage

Analysis

max time kernel
36s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 18:24

Sharing

Report Analysis Logs

General

Target

b725f0bbe837d2e83a3f6001743714950de5390f9a2038025bc417c9300ce533.dll
Size

3KB
MD5

d869475f054acf375812a80289e10c60
SHA1

68ae578360b96a169c9fa78af9d57b3cb9270863
SHA256

b725f0bbe837d2e83a3f6001743714950de5390f9a2038025bc417c9300ce533
SHA512

20d28aaff7005843152ed3f85279c0a54b7e2e0f8d603a9bb62d79ce0c08323a70869f5ecf1a9a96824df79f324ce3bf5965b48d721dd090c10dff9513ab7f2c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b725f0bbe837d2e83a3f6001743714950de5390f9a2038025bc417c9300ce533.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b725f0bbe837d2e83a3f6001743714950de5390f9a2038025bc417c9300ce533.dll,#1
  2⤵
  PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download