c847c9b5b1183d6abca7e4bd1ad8e377007e3a80e218b931a4ed187c6ee1a21c | Triage

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:40

Sharing

Report Analysis Logs

General

Target

c847c9b5b1183d6abca7e4bd1ad8e377007e3a80e218b931a4ed187c6ee1a21c.dll
Size

3KB
MD5

218db313729bfd270b41164e07a43420
SHA1

5bec62c1099ea75043f397376c75149a4a875f50
SHA256

c847c9b5b1183d6abca7e4bd1ad8e377007e3a80e218b931a4ed187c6ee1a21c
SHA512

11d4d56d8c78373c408d79f10b6f438f0bdbc227540e678d9ab27cfd3fbd63abb082da1027dc9a36e3e036944c91696b2cdfced85c181d130c6d271b2b93fbed

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1208	1752	rundll32.exe	28
PID 1752 wrote to memory of 1208	1752	rundll32.exe	28
PID 1752 wrote to memory of 1208	1752	rundll32.exe	28
PID 1752 wrote to memory of 1208	1752	rundll32.exe	28
PID 1752 wrote to memory of 1208	1752	rundll32.exe	28
PID 1752 wrote to memory of 1208	1752	rundll32.exe	28
PID 1752 wrote to memory of 1208	1752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c847c9b5b1183d6abca7e4bd1ad8e377007e3a80e218b931a4ed187c6ee1a21c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c847c9b5b1183d6abca7e4bd1ad8e377007e3a80e218b931a4ed187c6ee1a21c.dll,#1
  2⤵
  PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-55-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download