875af997be51a8e832a99dffb3f2b9c2fe6df42e7a51726ae76164bcc0df120a | Triage

Analysis

max time kernel
35s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 20:38

Sharing

Report Analysis Logs

General

Target

875af997be51a8e832a99dffb3f2b9c2fe6df42e7a51726ae76164bcc0df120a.dll
Size

3KB
MD5

287b1b6ac82f4cf98d338ddcdef9af80
SHA1

db62d341df1f45df95afccbbc69772420526cf78
SHA256

875af997be51a8e832a99dffb3f2b9c2fe6df42e7a51726ae76164bcc0df120a
SHA512

bcc8e96d2868658f3358a9afac211d95900debf0a8677b47e58f4d69234e3c7c38f30c8d23f6f474ef421dbb3c2ea079a72861fef4029d50751a2e98fe82d096

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1100	2040	rundll32.exe	28
PID 2040 wrote to memory of 1100	2040	rundll32.exe	28
PID 2040 wrote to memory of 1100	2040	rundll32.exe	28
PID 2040 wrote to memory of 1100	2040	rundll32.exe	28
PID 2040 wrote to memory of 1100	2040	rundll32.exe	28
PID 2040 wrote to memory of 1100	2040	rundll32.exe	28
PID 2040 wrote to memory of 1100	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\875af997be51a8e832a99dffb3f2b9c2fe6df42e7a51726ae76164bcc0df120a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\875af997be51a8e832a99dffb3f2b9c2fe6df42e7a51726ae76164bcc0df120a.dll,#1
  2⤵
  PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-54-0x0000000000000000-mapping.dmp

Download
memory/1100-55-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download