6a729011f648949eee03cf4f012fd23515371588374d15d4da779160c6e8273b | Triage

Analysis

max time kernel
32s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:38

Sharing

Report Analysis Logs

General

Target

6a729011f648949eee03cf4f012fd23515371588374d15d4da779160c6e8273b.dll
Size

3KB
MD5

0eca833fe06399ebfb9f8a215a4f43f0
SHA1

9036bfc0dd65bbe7f4aa50a74600a15171d33168
SHA256

6a729011f648949eee03cf4f012fd23515371588374d15d4da779160c6e8273b
SHA512

33bc8f9fada6ad56157f5dfb28e06911fdd2e9a9d7ce4e5b527ad7917820e95d7a6164eb64eeb08348c45dbebc479d8afb6e97eca56cc8ca8a6a81d0281ee339

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2044	1944	rundll32.exe	24
PID 1944 wrote to memory of 2044	1944	rundll32.exe	24
PID 1944 wrote to memory of 2044	1944	rundll32.exe	24
PID 1944 wrote to memory of 2044	1944	rundll32.exe	24
PID 1944 wrote to memory of 2044	1944	rundll32.exe	24
PID 1944 wrote to memory of 2044	1944	rundll32.exe	24
PID 1944 wrote to memory of 2044	1944	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a729011f648949eee03cf4f012fd23515371588374d15d4da779160c6e8273b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a729011f648949eee03cf4f012fd23515371588374d15d4da779160c6e8273b.dll,#1
  2⤵
  PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download