5e23a8a197737788fb6e566519f968298439e5b4d825e7d86c543d16a15065de | Triage

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 18:27

Sharing

Report Analysis Logs

General

Target

5e23a8a197737788fb6e566519f968298439e5b4d825e7d86c543d16a15065de.dll
Size

3KB
MD5

7b6ddd74922270fce2d0b5344d105a40
SHA1

dab64c9f7c115ae71854ad0de7398d055305f0ea
SHA256

5e23a8a197737788fb6e566519f968298439e5b4d825e7d86c543d16a15065de
SHA512

41bbd3bb5d572e381fb0196c2277a61315216078b2330ad09ce2c97e16c067405df749d6a8d52cc06665f450973b22f2d51393153da59477a67826515908b60c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1984	1148	rundll32.exe	26
PID 1148 wrote to memory of 1984	1148	rundll32.exe	26
PID 1148 wrote to memory of 1984	1148	rundll32.exe	26
PID 1148 wrote to memory of 1984	1148	rundll32.exe	26
PID 1148 wrote to memory of 1984	1148	rundll32.exe	26
PID 1148 wrote to memory of 1984	1148	rundll32.exe	26
PID 1148 wrote to memory of 1984	1148	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e23a8a197737788fb6e566519f968298439e5b4d825e7d86c543d16a15065de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e23a8a197737788fb6e566519f968298439e5b4d825e7d86c543d16a15065de.dll,#1
  2⤵
  PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-54-0x0000000000000000-mapping.dmp

Download
memory/1984-55-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download