77ac04d9b463046cceb0d1066fe312dbedcde99809f554a19eb85113a55f664e | Triage

Analysis

max time kernel
22s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 18:20

Sharing

Report Analysis Logs

General

Target

77ac04d9b463046cceb0d1066fe312dbedcde99809f554a19eb85113a55f664e.dll
Size

3KB
MD5

f654f07a78c18b7861fcdd37b3c5a8ab
SHA1

40d036e0b31f6b9cd14ebe0fb9eebc6a41881d36
SHA256

77ac04d9b463046cceb0d1066fe312dbedcde99809f554a19eb85113a55f664e
SHA512

5e7119f630e1d1d8679d97957c7099ebf0c8b615b97153a67a92171880980c1c5b2a70fcb0de8d7f37e178f1cf66cab5a2509252bee196244a6aff57ae5164db

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1108	2036	rundll32.exe	28
PID 2036 wrote to memory of 1108	2036	rundll32.exe	28
PID 2036 wrote to memory of 1108	2036	rundll32.exe	28
PID 2036 wrote to memory of 1108	2036	rundll32.exe	28
PID 2036 wrote to memory of 1108	2036	rundll32.exe	28
PID 2036 wrote to memory of 1108	2036	rundll32.exe	28
PID 2036 wrote to memory of 1108	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77ac04d9b463046cceb0d1066fe312dbedcde99809f554a19eb85113a55f664e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\77ac04d9b463046cceb0d1066fe312dbedcde99809f554a19eb85113a55f664e.dll,#1
  2⤵
  PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download