df00ad172e6d50680ea5fcee2afdb7b2aaa6ab4f5fa5bd735cc38e9c3edf2d99 | Triage

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 20:42

Sharing

Report Analysis Logs

General

Target

df00ad172e6d50680ea5fcee2afdb7b2aaa6ab4f5fa5bd735cc38e9c3edf2d99.dll
Size

3KB
MD5

44d23c78fb2e9352bb8000c9d2edd860
SHA1

c25da802cd5d35d6808ffbcd2b9b283a15bf7c3a
SHA256

df00ad172e6d50680ea5fcee2afdb7b2aaa6ab4f5fa5bd735cc38e9c3edf2d99
SHA512

2309ba3241bc78e8311ac476253d7038c219da63ce52905bb04397526f774f95767cbc86959f2e73ddbec9df04e5c1286d7be00beca9b3e324d8a4b3f63fb1b8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1124	1700	rundll32.exe	28
PID 1700 wrote to memory of 1124	1700	rundll32.exe	28
PID 1700 wrote to memory of 1124	1700	rundll32.exe	28
PID 1700 wrote to memory of 1124	1700	rundll32.exe	28
PID 1700 wrote to memory of 1124	1700	rundll32.exe	28
PID 1700 wrote to memory of 1124	1700	rundll32.exe	28
PID 1700 wrote to memory of 1124	1700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df00ad172e6d50680ea5fcee2afdb7b2aaa6ab4f5fa5bd735cc38e9c3edf2d99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\df00ad172e6d50680ea5fcee2afdb7b2aaa6ab4f5fa5bd735cc38e9c3edf2d99.dll,#1
  2⤵
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-54-0x0000000000000000-mapping.dmp

Download
memory/1124-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download