dadec9b23846e0bb1a24f29a36efbfa325a922c388953a3d3fb0fbbf3898a25a | Triage

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:13

Sharing

Report Analysis Logs

General

Target

dadec9b23846e0bb1a24f29a36efbfa325a922c388953a3d3fb0fbbf3898a25a.dll
Size

4KB
MD5

736d83b0b10435bc9e2a770d5d40b140
SHA1

153abb26f98ca5d08901b2511f21b42a473099df
SHA256

dadec9b23846e0bb1a24f29a36efbfa325a922c388953a3d3fb0fbbf3898a25a
SHA512

d4457bb79602115408706b320a59297f41ba9cb9d1c17a56df592731dae594361199b07ee4f87000d3734f957708ba0da73546217570479cc645f0d10969eb97

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 900	1956	rundll32.exe	27
PID 1956 wrote to memory of 900	1956	rundll32.exe	27
PID 1956 wrote to memory of 900	1956	rundll32.exe	27
PID 1956 wrote to memory of 900	1956	rundll32.exe	27
PID 1956 wrote to memory of 900	1956	rundll32.exe	27
PID 1956 wrote to memory of 900	1956	rundll32.exe	27
PID 1956 wrote to memory of 900	1956	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dadec9b23846e0bb1a24f29a36efbfa325a922c388953a3d3fb0fbbf3898a25a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dadec9b23846e0bb1a24f29a36efbfa325a922c388953a3d3fb0fbbf3898a25a.dll,#1
  2⤵
  PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download