8f19bd9f6c36a77149ec768abe12b824177e070e236a967fdd75ad07ed791df0 | Triage

Analysis

max time kernel
51s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 09:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8f19bd9f6c36a77149ec768abe12b824177e070e236a967fdd75ad07ed791df0.dll
Size

3KB
MD5

ab69b3a82c581a2d1fba88ace1dc8b90
SHA1

0dcd07ed73e9cce1c44146cf59a328ab607fb333
SHA256

8f19bd9f6c36a77149ec768abe12b824177e070e236a967fdd75ad07ed791df0
SHA512

029b842c584e794ba391e97840ff9946f603bf37da353048fdade501a8854df16934e90fe9c34680dec4098eec24fc8d8bd9eaceda4b2ce72ba744044c7f0628

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1364	1616	rundll32.exe	28
PID 1616 wrote to memory of 1364	1616	rundll32.exe	28
PID 1616 wrote to memory of 1364	1616	rundll32.exe	28
PID 1616 wrote to memory of 1364	1616	rundll32.exe	28
PID 1616 wrote to memory of 1364	1616	rundll32.exe	28
PID 1616 wrote to memory of 1364	1616	rundll32.exe	28
PID 1616 wrote to memory of 1364	1616	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f19bd9f6c36a77149ec768abe12b824177e070e236a967fdd75ad07ed791df0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f19bd9f6c36a77149ec768abe12b824177e070e236a967fdd75ad07ed791df0.dll,#1
  2⤵
  PID:1364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-55-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download