9ae5bfe2cb2131eba508b3ea11c7dccdac3464a0393146d54226787a671d7b71 | Triage

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 09:18

Sharing

Report Analysis Logs

General

Target

9ae5bfe2cb2131eba508b3ea11c7dccdac3464a0393146d54226787a671d7b71.dll
Size

3KB
MD5

391d4bdd94307e8c53aac13064a8fa70
SHA1

40203788a4b48808ce78a41c71c270b84c9e40f7
SHA256

9ae5bfe2cb2131eba508b3ea11c7dccdac3464a0393146d54226787a671d7b71
SHA512

8e385bbf48082f7242b24cf6d9e4e6f245f5fc04810d78ed4a4757cc664f0d7a1e165cb138c6174dcdcb834177b2cbb6bc8531955b7c35a8ea112d5c634952f1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ae5bfe2cb2131eba508b3ea11c7dccdac3464a0393146d54226787a671d7b71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ae5bfe2cb2131eba508b3ea11c7dccdac3464a0393146d54226787a671d7b71.dll,#1
  2⤵
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download