987745b5176b434244efe63541be709f7bc0cdf4b57b44f6523d1b1b2bfd9580 | Triage

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 18:19

Sharing

Report Analysis Logs

General

Target

987745b5176b434244efe63541be709f7bc0cdf4b57b44f6523d1b1b2bfd9580.dll
Size

3KB
MD5

f1dae4fc2f25b90039de93b91ce5f437
SHA1

7d4701bcc5c64f64839c290c9bab8a5385e9711e
SHA256

987745b5176b434244efe63541be709f7bc0cdf4b57b44f6523d1b1b2bfd9580
SHA512

1288a758ecb10830020bde161b1a76d7bd685c611bb4936c4be0886ea43671cc1034a3fba5e5cb3fd9575e8fc29b26257686a63fafb248f3f620f54e1582750e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1808	1972	rundll32.exe	28
PID 1972 wrote to memory of 1808	1972	rundll32.exe	28
PID 1972 wrote to memory of 1808	1972	rundll32.exe	28
PID 1972 wrote to memory of 1808	1972	rundll32.exe	28
PID 1972 wrote to memory of 1808	1972	rundll32.exe	28
PID 1972 wrote to memory of 1808	1972	rundll32.exe	28
PID 1972 wrote to memory of 1808	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\987745b5176b434244efe63541be709f7bc0cdf4b57b44f6523d1b1b2bfd9580.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\987745b5176b434244efe63541be709f7bc0cdf4b57b44f6523d1b1b2bfd9580.dll,#1
  2⤵
  PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download