718011073dc2f4cd17b9b62e0e745573aa730cdaf31c6b0548fab3d80b2bec17 | Triage

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 00:24

Sharing

Report Analysis Logs

General

Target

718011073dc2f4cd17b9b62e0e745573aa730cdaf31c6b0548fab3d80b2bec17.dll
Size

4KB
MD5

16870f396a429d6d8c3bf3280015f640
SHA1

0379585a95a3a700a6b7a62e21174719beaa1107
SHA256

718011073dc2f4cd17b9b62e0e745573aa730cdaf31c6b0548fab3d80b2bec17
SHA512

911b5bb8beafffca7a3ebab299ce26b5ec213efd00698c1c89625861c5a10c002294ff13608031a15c144ac2eb0c5ecdcb9c1547460bfecd81cef8c00f52aca7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\718011073dc2f4cd17b9b62e0e745573aa730cdaf31c6b0548fab3d80b2bec17.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\718011073dc2f4cd17b9b62e0e745573aa730cdaf31c6b0548fab3d80b2bec17.dll,#1
  2⤵
  PID:1236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download