47e36853bc88ec698ba80b078af5d7042f47e8b77df2e13cfd1d6fee82764401 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 00:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

47e36853bc88ec698ba80b078af5d7042f47e8b77df2e13cfd1d6fee82764401.dll
Size

3KB
MD5

8db007c8d1d03c5d9ba32bdc01b12f50
SHA1

52f7ed752b059816a135ee29edee6acd40bf2666
SHA256

47e36853bc88ec698ba80b078af5d7042f47e8b77df2e13cfd1d6fee82764401
SHA512

1881beafdddd1152cd708a6a1faa6272bcebdc15a1cd7c0fd862e9d22625cc593fd7d7314294269fe81aae27eb835f88548d05ab38890714e1c4212cb9ac3215

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1116	1948	rundll32.exe	28
PID 1948 wrote to memory of 1116	1948	rundll32.exe	28
PID 1948 wrote to memory of 1116	1948	rundll32.exe	28
PID 1948 wrote to memory of 1116	1948	rundll32.exe	28
PID 1948 wrote to memory of 1116	1948	rundll32.exe	28
PID 1948 wrote to memory of 1116	1948	rundll32.exe	28
PID 1948 wrote to memory of 1116	1948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47e36853bc88ec698ba80b078af5d7042f47e8b77df2e13cfd1d6fee82764401.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47e36853bc88ec698ba80b078af5d7042f47e8b77df2e13cfd1d6fee82764401.dll,#1
  2⤵
  PID:1116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-55-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download