f5f4bbb8e5da50b80a212f2c953c7a0b91431ad2c1075adbf963d730a7becd60 | Triage

Analysis

max time kernel
52s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 01:37

Sharing

Report Analysis Logs

General

Target

f5f4bbb8e5da50b80a212f2c953c7a0b91431ad2c1075adbf963d730a7becd60.dll
Size

3KB
MD5

f87b38734de82499c24f573755ca6dc0
SHA1

69e73399ea8f2eeea8660a4f9edd9e4f93928aa5
SHA256

f5f4bbb8e5da50b80a212f2c953c7a0b91431ad2c1075adbf963d730a7becd60
SHA512

a105f391fe7f8a65907f4ee73d1d2e79c9545ae6636c0723c948c5ddfd401dc3dbb8516637aca0d5a20112f5eedf7e79191e6402112f28b75ab26aae2310bf5c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1968	2008	rundll32.exe	27
PID 2008 wrote to memory of 1968	2008	rundll32.exe	27
PID 2008 wrote to memory of 1968	2008	rundll32.exe	27
PID 2008 wrote to memory of 1968	2008	rundll32.exe	27
PID 2008 wrote to memory of 1968	2008	rundll32.exe	27
PID 2008 wrote to memory of 1968	2008	rundll32.exe	27
PID 2008 wrote to memory of 1968	2008	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5f4bbb8e5da50b80a212f2c953c7a0b91431ad2c1075adbf963d730a7becd60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5f4bbb8e5da50b80a212f2c953c7a0b91431ad2c1075adbf963d730a7becd60.dll,#1
  2⤵
  PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download