023629a125b1874a992396f2c95805d869c81c5a07dc3b77ab91011dffc3aca4 | Triage

Analysis

max time kernel
234s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 20:46

Sharing

Report Analysis Logs

General

Target

023629a125b1874a992396f2c95805d869c81c5a07dc3b77ab91011dffc3aca4.dll
Size

3KB
MD5

f2b44ab9930f041dc7f2845dc89b71a0
SHA1

9f6174959a7c76dc44be5f04dd67fe5f3538482c
SHA256

023629a125b1874a992396f2c95805d869c81c5a07dc3b77ab91011dffc3aca4
SHA512

daf96f0eec3c61bf2c5f2bf396f967a7ef33d02707479ef20e9c2f78093a9c817a6ea5f79c9fd83047453721362d30d09343f287895e9ec6ed150f8ed52e7c86

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 268 wrote to memory of 1116	268	rundll32.exe	28
PID 268 wrote to memory of 1116	268	rundll32.exe	28
PID 268 wrote to memory of 1116	268	rundll32.exe	28
PID 268 wrote to memory of 1116	268	rundll32.exe	28
PID 268 wrote to memory of 1116	268	rundll32.exe	28
PID 268 wrote to memory of 1116	268	rundll32.exe	28
PID 268 wrote to memory of 1116	268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\023629a125b1874a992396f2c95805d869c81c5a07dc3b77ab91011dffc3aca4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\023629a125b1874a992396f2c95805d869c81c5a07dc3b77ab91011dffc3aca4.dll,#1
  2⤵
  PID:1116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-55-0x0000000076931000-0x0000000076933000-memory.dmp

Filesize
8KB

Download