7ec9b635385a2070a57b7a01a50a3ee8ea57f013b444793d6f59ad7b7c53396a | Triage

Analysis

max time kernel
134s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 00:23

Sharing

Report Analysis Logs

General

Target

7ec9b635385a2070a57b7a01a50a3ee8ea57f013b444793d6f59ad7b7c53396a.dll
Size

4KB
MD5

97af1ed3ed9b1e53cb924e4dd6b400f0
SHA1

9a7b8e88851de0ad9aaa0ff975fdb66e670e707c
SHA256

7ec9b635385a2070a57b7a01a50a3ee8ea57f013b444793d6f59ad7b7c53396a
SHA512

41099323c5d569ba5f24ed9b2884d8ed726d55cc56544202a801cec730b7acc8575b51eb5917ae26ad80f2d941f21d8935b4e51b6630cd6efb3423ec46cebd02

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 3824	5040	rundll32.exe	79
PID 5040 wrote to memory of 3824	5040	rundll32.exe	79
PID 5040 wrote to memory of 3824	5040	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ec9b635385a2070a57b7a01a50a3ee8ea57f013b444793d6f59ad7b7c53396a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ec9b635385a2070a57b7a01a50a3ee8ea57f013b444793d6f59ad7b7c53396a.dll,#1
  2⤵
  PID:3824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads