761523b0dc13f2507e072a10371fd18bc1dbbd9ee0805b0ced85b643ab5ce375 | Triage

Analysis

max time kernel
39s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 13:34

Sharing

Report Analysis Logs

General

Target

761523b0dc13f2507e072a10371fd18bc1dbbd9ee0805b0ced85b643ab5ce375.dll
Size

4KB
MD5

d53b8124490ff11b33b352019cace820
SHA1

de12f2b8f3a74c3f5b907befbc02589fa19eec40
SHA256

761523b0dc13f2507e072a10371fd18bc1dbbd9ee0805b0ced85b643ab5ce375
SHA512

640d279b5199f9bb42dc59ae1df8e6e1777234401f103e976bb12dc0799722ca7df90e8659c912c1344b2f9ea885566d0c2cc2ddd850ec046bc1d2e8b310dc76

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\761523b0dc13f2507e072a10371fd18bc1dbbd9ee0805b0ced85b643ab5ce375.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\761523b0dc13f2507e072a10371fd18bc1dbbd9ee0805b0ced85b643ab5ce375.dll,#1
  2⤵
  PID:1376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-55-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download