de68b4f55c290cfe3412093cd5f8d62c7d99de5fc986c0fe631eca8aeeedfb5a | Triage

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 11:29

Sharing

Report Analysis Logs

General

Target

de68b4f55c290cfe3412093cd5f8d62c7d99de5fc986c0fe631eca8aeeedfb5a.dll
Size

4KB
MD5

ef047626cca209b3c5303764477f3a90
SHA1

d78e252f95dde52cff7c987abe945fa9a443a48e
SHA256

de68b4f55c290cfe3412093cd5f8d62c7d99de5fc986c0fe631eca8aeeedfb5a
SHA512

cb1ccc907a22809524498d02d1fca80133f8e3366b19f9d595c0ec3f49961a54c35c56b6fbcf80bbe907b606868c928efd4f0c5093268688e0f562044497d0d5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de68b4f55c290cfe3412093cd5f8d62c7d99de5fc986c0fe631eca8aeeedfb5a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de68b4f55c290cfe3412093cd5f8d62c7d99de5fc986c0fe631eca8aeeedfb5a.dll,#1
  2⤵
  PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download