0f507c30f6f8878a6536dc8c48caaa05a9027883be1746e71ec1dea5aedcf694 | Triage

Analysis

max time kernel
37s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:50

Sharing

Report Analysis Logs

General

Target

0f507c30f6f8878a6536dc8c48caaa05a9027883be1746e71ec1dea5aedcf694.dll
Size

4KB
MD5

d43ff470130e7c471db945e287ddcc50
SHA1

a87ed566dc08c81d434e1a3cbced5ac5a25fcb1a
SHA256

0f507c30f6f8878a6536dc8c48caaa05a9027883be1746e71ec1dea5aedcf694
SHA512

3815e28428cff199759ab40aceb90eadfe3c65383a77438317a355d8cad4decd86710c6137d702f42a6f2b8ca8ada571c06c830cd0d83945824844b9a533dcf7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1384	1112	rundll32.exe	26
PID 1112 wrote to memory of 1384	1112	rundll32.exe	26
PID 1112 wrote to memory of 1384	1112	rundll32.exe	26
PID 1112 wrote to memory of 1384	1112	rundll32.exe	26
PID 1112 wrote to memory of 1384	1112	rundll32.exe	26
PID 1112 wrote to memory of 1384	1112	rundll32.exe	26
PID 1112 wrote to memory of 1384	1112	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f507c30f6f8878a6536dc8c48caaa05a9027883be1746e71ec1dea5aedcf694.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f507c30f6f8878a6536dc8c48caaa05a9027883be1746e71ec1dea5aedcf694.dll,#1
  2⤵
  PID:1384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-55-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download