908360efe81ce69a5db6be81b1980a915f5fb995c83237d65694c1ceb03a2e8c | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 22:04

Sharing

Report Analysis Logs

General

Target

908360efe81ce69a5db6be81b1980a915f5fb995c83237d65694c1ceb03a2e8c.dll
Size

3KB
MD5

5685d58facbf6901e9748f9ce03a7c2a
SHA1

3a8ac23cc79fc0bb71181e32f9b71e845bbbc47c
SHA256

908360efe81ce69a5db6be81b1980a915f5fb995c83237d65694c1ceb03a2e8c
SHA512

c92a1eef02e22da299a77a74dd32369d3dcef02c4abe7de46795256e37045d3ef8c7635ee88ce5ef7d9ceb436ae28555ac8b0cc3aaa5c992eae717751f5f57ef

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1952	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\908360efe81ce69a5db6be81b1980a915f5fb995c83237d65694c1ceb03a2e8c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\908360efe81ce69a5db6be81b1980a915f5fb995c83237d65694c1ceb03a2e8c.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download