c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c | Triage

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 01:05

Sharing

Report Analysis Logs

General

Target

c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c.dll
Size

3KB
MD5

a47efb2907348015f77d6e2b80a5ad30
SHA1

3eb8aa8bc4a54981be8ec5112a92bca9cb316ac7
SHA256

c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c
SHA512

2083af7487e49a6081349862be736a67e3344d176ddcb75ec13e70ae0fa9ad0ed1849790d2f25f5aa6e75d1bde187a0abb88350fb6962fab88f54a7a92d675fe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1924	1172	rundll32.exe	27
PID 1172 wrote to memory of 1924	1172	rundll32.exe	27
PID 1172 wrote to memory of 1924	1172	rundll32.exe	27
PID 1172 wrote to memory of 1924	1172	rundll32.exe	27
PID 1172 wrote to memory of 1924	1172	rundll32.exe	27
PID 1172 wrote to memory of 1924	1172	rundll32.exe	27
PID 1172 wrote to memory of 1924	1172	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1370db3e617fa668c646c4cbe76e5f4788df087043de0c31b4b379dd317c90c.dll,#1
  2⤵
  PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download