b4244cc374d86c21ff91d67cb752a859201bdeee4a3454313b61d45a8f30bee7 | Triage

Analysis

max time kernel
96s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 20:36

Sharing

Report Analysis Logs

General

Target

b4244cc374d86c21ff91d67cb752a859201bdeee4a3454313b61d45a8f30bee7.dll
Size

3KB
MD5

46f21cfb8b21de865f0ee724c5bfbaac
SHA1

b5bae33448094cd6313fa790c151e104c2a880f6
SHA256

b4244cc374d86c21ff91d67cb752a859201bdeee4a3454313b61d45a8f30bee7
SHA512

a1125ab6773fb5e18ab6c6d9582a4e283080735d986c3c0066793ee521e75b6c1c7f931b7d615234fac816f267ecff1207ed904e509a4402b019790f34163873

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 588	1648	rundll32.exe	28
PID 1648 wrote to memory of 588	1648	rundll32.exe	28
PID 1648 wrote to memory of 588	1648	rundll32.exe	28
PID 1648 wrote to memory of 588	1648	rundll32.exe	28
PID 1648 wrote to memory of 588	1648	rundll32.exe	28
PID 1648 wrote to memory of 588	1648	rundll32.exe	28
PID 1648 wrote to memory of 588	1648	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4244cc374d86c21ff91d67cb752a859201bdeee4a3454313b61d45a8f30bee7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4244cc374d86c21ff91d67cb752a859201bdeee4a3454313b61d45a8f30bee7.dll,#1
  2⤵
  PID:588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-55-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download