628fec09118376e85b67059baf47bf43d265f24d94fd681fa3ab1b5ba2e0a02f | Triage

Analysis

max time kernel
13s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 20:45

Sharing

Report Analysis Logs

General

Target

628fec09118376e85b67059baf47bf43d265f24d94fd681fa3ab1b5ba2e0a02f.dll
Size

3KB
MD5

0be0fa3b7cc4abedac0f7ae9b0ba449e
SHA1

c4aabb44cf1169a728ae5186b2cd87e4f1049404
SHA256

628fec09118376e85b67059baf47bf43d265f24d94fd681fa3ab1b5ba2e0a02f
SHA512

ad72d39301c8b11bde07e3d0ae97e89626c8923e36e08f2c8ae0489c723f9e1f9767c6641e05a329abe16ff434ede5e89ceeee8ef4f00fa757829ffc1d59b0fd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1116	1792	rundll32.exe	28
PID 1792 wrote to memory of 1116	1792	rundll32.exe	28
PID 1792 wrote to memory of 1116	1792	rundll32.exe	28
PID 1792 wrote to memory of 1116	1792	rundll32.exe	28
PID 1792 wrote to memory of 1116	1792	rundll32.exe	28
PID 1792 wrote to memory of 1116	1792	rundll32.exe	28
PID 1792 wrote to memory of 1116	1792	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\628fec09118376e85b67059baf47bf43d265f24d94fd681fa3ab1b5ba2e0a02f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\628fec09118376e85b67059baf47bf43d265f24d94fd681fa3ab1b5ba2e0a02f.dll,#1
  2⤵
  PID:1116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-55-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download