9ca041ead868cba15ade72b18f6d7b15d98a1b5dcc6cd563bc6555b50d69dc14 | Triage

Analysis

max time kernel
33s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9ca041ead868cba15ade72b18f6d7b15d98a1b5dcc6cd563bc6555b50d69dc14.dll
Size

4KB
MD5

20b1ac8519c94a08e82635382b9d3010
SHA1

3e20afca6a299a255c1af0c18650affb2b378750
SHA256

9ca041ead868cba15ade72b18f6d7b15d98a1b5dcc6cd563bc6555b50d69dc14
SHA512

08c7795a3dcf2bfd5ecb7223e5dc251fcc97026fd67e4cf31a4b7934f2ab1d9330be28210dab52127a7680b02e93ec4574bafd4a04f29862896f8446ee4e5ed1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 1520	328	rundll32.exe	27
PID 328 wrote to memory of 1520	328	rundll32.exe	27
PID 328 wrote to memory of 1520	328	rundll32.exe	27
PID 328 wrote to memory of 1520	328	rundll32.exe	27
PID 328 wrote to memory of 1520	328	rundll32.exe	27
PID 328 wrote to memory of 1520	328	rundll32.exe	27
PID 328 wrote to memory of 1520	328	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ca041ead868cba15ade72b18f6d7b15d98a1b5dcc6cd563bc6555b50d69dc14.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ca041ead868cba15ade72b18f6d7b15d98a1b5dcc6cd563bc6555b50d69dc14.dll,#1
  2⤵
  PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-55-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download