5005bc8994d41ed6d6b0d5f9ec1f1fd5319ebb95d79f6f5c91f9cb711ecc7b30 | Triage

Analysis

max time kernel
98s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 00:28

Sharing

Report Analysis Logs

General

Target

5005bc8994d41ed6d6b0d5f9ec1f1fd5319ebb95d79f6f5c91f9cb711ecc7b30.dll
Size

4KB
MD5

40060d56fd245f90131bfcb73bedf830
SHA1

2b7c1ee5b61b41d7a07758302035ff4bd368d77d
SHA256

5005bc8994d41ed6d6b0d5f9ec1f1fd5319ebb95d79f6f5c91f9cb711ecc7b30
SHA512

f673e11a1f0390fccb12e86650d605d4d7ef1ce47bfaea4147f267eb6489b5133e00f1b2604c66a0209390274f87733b10ab65a532aa21d6748d82bf29421882

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1124	580	rundll32.exe	28
PID 580 wrote to memory of 1124	580	rundll32.exe	28
PID 580 wrote to memory of 1124	580	rundll32.exe	28
PID 580 wrote to memory of 1124	580	rundll32.exe	28
PID 580 wrote to memory of 1124	580	rundll32.exe	28
PID 580 wrote to memory of 1124	580	rundll32.exe	28
PID 580 wrote to memory of 1124	580	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5005bc8994d41ed6d6b0d5f9ec1f1fd5319ebb95d79f6f5c91f9cb711ecc7b30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5005bc8994d41ed6d6b0d5f9ec1f1fd5319ebb95d79f6f5c91f9cb711ecc7b30.dll,#1
  2⤵
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-54-0x0000000000000000-mapping.dmp

Download
memory/1124-55-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download