6f25c53cf08d3da5acf7c4acd1f2d2944e44eee3046eb8fb91472e2bf72dbf34 | Triage

Analysis

max time kernel
246s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 00:25

Sharing

Report Analysis Logs

General

Target

6f25c53cf08d3da5acf7c4acd1f2d2944e44eee3046eb8fb91472e2bf72dbf34.dll
Size

4KB
MD5

5279ce9acfa7a16892e5f583941cc610
SHA1

f1d569abe6047bec0a33d554b6f263ab10c2d0ab
SHA256

6f25c53cf08d3da5acf7c4acd1f2d2944e44eee3046eb8fb91472e2bf72dbf34
SHA512

8977db032134336747b348f746e8211cd4839e093ceae465b5af990fb67b4a34084adc1c6c031c8247abf6c88fdf00cea3e952d67ee4b54ad02fbf58b864f3ed

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 580	1220	rundll32.exe	28
PID 1220 wrote to memory of 580	1220	rundll32.exe	28
PID 1220 wrote to memory of 580	1220	rundll32.exe	28
PID 1220 wrote to memory of 580	1220	rundll32.exe	28
PID 1220 wrote to memory of 580	1220	rundll32.exe	28
PID 1220 wrote to memory of 580	1220	rundll32.exe	28
PID 1220 wrote to memory of 580	1220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f25c53cf08d3da5acf7c4acd1f2d2944e44eee3046eb8fb91472e2bf72dbf34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f25c53cf08d3da5acf7c4acd1f2d2944e44eee3046eb8fb91472e2bf72dbf34.dll,#1
  2⤵
  PID:580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download