a1a5f09d5c074fb31b02f30a59e922962dbdd6067c059df8dba4fbc1bc80f541 | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 20:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a1a5f09d5c074fb31b02f30a59e922962dbdd6067c059df8dba4fbc1bc80f541.dll
Size

3KB
MD5

4e35c414861b02551373de25e909220a
SHA1

080d9f1778efe7d47b0a193611f973afb273770f
SHA256

a1a5f09d5c074fb31b02f30a59e922962dbdd6067c059df8dba4fbc1bc80f541
SHA512

a5a701319ec8a4591980c28b10810d55e7e7be4486117257b5efa33433271d833fd7a11adc13910a28cb17bbc18dcd6816326f2c9c3e6c764967ac3299fc5fc7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1696	852	rundll32.exe	27
PID 852 wrote to memory of 1696	852	rundll32.exe	27
PID 852 wrote to memory of 1696	852	rundll32.exe	27
PID 852 wrote to memory of 1696	852	rundll32.exe	27
PID 852 wrote to memory of 1696	852	rundll32.exe	27
PID 852 wrote to memory of 1696	852	rundll32.exe	27
PID 852 wrote to memory of 1696	852	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1a5f09d5c074fb31b02f30a59e922962dbdd6067c059df8dba4fbc1bc80f541.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1a5f09d5c074fb31b02f30a59e922962dbdd6067c059df8dba4fbc1bc80f541.dll,#1
  2⤵
  PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1696-55-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download