e9da182476ef50ccee14c690555913b9587cae00d571d52929734c8021a45d15 | Triage

Analysis

max time kernel
239s
max time network
332s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:12

Sharing

Report Analysis Logs

General

Target

e9da182476ef50ccee14c690555913b9587cae00d571d52929734c8021a45d15.dll
Size

4KB
MD5

6d7a8dd8faa5ea281b35957db837c030
SHA1

28953166b3c9e7365cbe4ef699da8c6839117cab
SHA256

e9da182476ef50ccee14c690555913b9587cae00d571d52929734c8021a45d15
SHA512

5c04b129069ae230ed8a85160c38afec36b81e64051292ea3367663e6e050ebfaf2c4b1d1725bdfd8ecb51f57c283ae5b922d9d6e312d83d81eeb4c0ca47c61f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 1044	528	rundll32.exe	28
PID 528 wrote to memory of 1044	528	rundll32.exe	28
PID 528 wrote to memory of 1044	528	rundll32.exe	28
PID 528 wrote to memory of 1044	528	rundll32.exe	28
PID 528 wrote to memory of 1044	528	rundll32.exe	28
PID 528 wrote to memory of 1044	528	rundll32.exe	28
PID 528 wrote to memory of 1044	528	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9da182476ef50ccee14c690555913b9587cae00d571d52929734c8021a45d15.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9da182476ef50ccee14c690555913b9587cae00d571d52929734c8021a45d15.dll,#1
  2⤵
  PID:1044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-55-0x0000000076931000-0x0000000076933000-memory.dmp

Filesize
8KB

Download