7ec9b635385a2070a57b7a01a50a3ee8ea57f013b444793d6f59ad7b7c53396a | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 00:23

Sharing

Report Analysis Logs

General

Target

7ec9b635385a2070a57b7a01a50a3ee8ea57f013b444793d6f59ad7b7c53396a.dll
Size

4KB
MD5

97af1ed3ed9b1e53cb924e4dd6b400f0
SHA1

9a7b8e88851de0ad9aaa0ff975fdb66e670e707c
SHA256

7ec9b635385a2070a57b7a01a50a3ee8ea57f013b444793d6f59ad7b7c53396a
SHA512

41099323c5d569ba5f24ed9b2884d8ed726d55cc56544202a801cec730b7acc8575b51eb5917ae26ad80f2d941f21d8935b4e51b6630cd6efb3423ec46cebd02

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ec9b635385a2070a57b7a01a50a3ee8ea57f013b444793d6f59ad7b7c53396a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ec9b635385a2070a57b7a01a50a3ee8ea57f013b444793d6f59ad7b7c53396a.dll,#1
  2⤵
  PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-55-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download