f9743bebdf5ebea790449b3bb013406c7a5943e0441b24d7badd8e0a20334fac | Triage

Analysis

max time kernel
36s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:48

Sharing

Report Analysis Logs

General

Target

f9743bebdf5ebea790449b3bb013406c7a5943e0441b24d7badd8e0a20334fac.dll
Size

4KB
MD5

7b9b7fed421e9f44581d251843bab100
SHA1

db5a599220311f4b8873c4832550c472bf757c01
SHA256

f9743bebdf5ebea790449b3bb013406c7a5943e0441b24d7badd8e0a20334fac
SHA512

a49c7601592981ccadda57d94cdb017c301e701b472c5d7083788c4f1cddcc50138e92d61e453dfa5d14d8ab5c037b453633112447e0ccdbe59ba5d2695ffa8d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1992	2012	rundll32.exe	28
PID 2012 wrote to memory of 1992	2012	rundll32.exe	28
PID 2012 wrote to memory of 1992	2012	rundll32.exe	28
PID 2012 wrote to memory of 1992	2012	rundll32.exe	28
PID 2012 wrote to memory of 1992	2012	rundll32.exe	28
PID 2012 wrote to memory of 1992	2012	rundll32.exe	28
PID 2012 wrote to memory of 1992	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9743bebdf5ebea790449b3bb013406c7a5943e0441b24d7badd8e0a20334fac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9743bebdf5ebea790449b3bb013406c7a5943e0441b24d7badd8e0a20334fac.dll,#1
  2⤵
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-55-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download