de9a4d4ae938b90ffa3dac99e36c260be2df5aba226a8b20d33f3812bd5affd3 | Triage

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 20:35

Sharing

Report Analysis Logs

General

Target

de9a4d4ae938b90ffa3dac99e36c260be2df5aba226a8b20d33f3812bd5affd3.dll
Size

3KB
MD5

2acd40fb00d10d047dbf99d4370603a0
SHA1

016bd5632f912db071719a782ec0898b5b77e20d
SHA256

de9a4d4ae938b90ffa3dac99e36c260be2df5aba226a8b20d33f3812bd5affd3
SHA512

fe08fa42d1f9ffdb7c6902b65fabd59c327a636f38c9d35c0c1637285aa64bfc54badcbb8b6a75b3829d75b0f32756e5698b526fedf5203ea3b466a7e76f5d7d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de9a4d4ae938b90ffa3dac99e36c260be2df5aba226a8b20d33f3812bd5affd3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de9a4d4ae938b90ffa3dac99e36c260be2df5aba226a8b20d33f3812bd5affd3.dll,#1
  2⤵
  PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download