8faf664a4c9a7baa22c15cfdb641ecfa412f67367ab3ee3e996cd921ca8d0f72 | Triage

Analysis

max time kernel
5s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 11:51

Sharing

Report Analysis Logs

General

Target

8faf664a4c9a7baa22c15cfdb641ecfa412f67367ab3ee3e996cd921ca8d0f72.dll
Size

3KB
MD5

92a9c28532b18ae678c7949840d780d0
SHA1

fb2f87018fbb2fe7c2ba8b804307f900b87af2b1
SHA256

8faf664a4c9a7baa22c15cfdb641ecfa412f67367ab3ee3e996cd921ca8d0f72
SHA512

58e6e623e5bef79229a84b87aa61fa433fbce8e762c70e499296118f97f4e948b8e5eea30ca8943de4354c1e4130dcc2fcf7e162b09d1f51b3f390feb2d95b81

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8faf664a4c9a7baa22c15cfdb641ecfa412f67367ab3ee3e996cd921ca8d0f72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8faf664a4c9a7baa22c15cfdb641ecfa412f67367ab3ee3e996cd921ca8d0f72.dll,#1
  2⤵
  PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download