cb434c85604f5200e4345305e3f8762993260177caae17dd2e60693af3492610 | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 00:15

Sharing

Report Analysis Logs

General

Target

cb434c85604f5200e4345305e3f8762993260177caae17dd2e60693af3492610.dll
Size

4KB
MD5

b4701ff42035743c4cf6d61c44a451e0
SHA1

874b34294d9d33b30f895a5a1b30195564f6937b
SHA256

cb434c85604f5200e4345305e3f8762993260177caae17dd2e60693af3492610
SHA512

0ffc06e63f576670655c75418960c5ea2ea1b8980f5540358c9625519ac7246591a70f316b335812a969cc3b2239a51ed11dec557050db260663c9e605005088

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27
PID 1104 wrote to memory of 1744	1104	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb434c85604f5200e4345305e3f8762993260177caae17dd2e60693af3492610.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb434c85604f5200e4345305e3f8762993260177caae17dd2e60693af3492610.dll,#1
  2⤵
  PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-54-0x0000000000000000-mapping.dmp

Download
memory/1744-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download