b16cfd9f3059a80404036d9d4851be86989433cdeecc21639372439be9cc7210 | Triage

Analysis

max time kernel
39s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:09

Sharing

Report Analysis Logs

General

Target

b16cfd9f3059a80404036d9d4851be86989433cdeecc21639372439be9cc7210.dll
Size

4KB
MD5

ec6000a8f1b5b2ed1492fbf94b680d60
SHA1

cf4c7cf4a8b75d3829cc97c0759b2f44ab2125cc
SHA256

b16cfd9f3059a80404036d9d4851be86989433cdeecc21639372439be9cc7210
SHA512

cddb7c767b58a50cd8fe1762cc5ca4529fe2c7e9332e61f5e585fc954f2385b3f7ca8bca0569f83a878d257e47b974b134ad83ac4370c38b0b9cbf41a806fc44

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1452	1676	rundll32.exe	28
PID 1676 wrote to memory of 1452	1676	rundll32.exe	28
PID 1676 wrote to memory of 1452	1676	rundll32.exe	28
PID 1676 wrote to memory of 1452	1676	rundll32.exe	28
PID 1676 wrote to memory of 1452	1676	rundll32.exe	28
PID 1676 wrote to memory of 1452	1676	rundll32.exe	28
PID 1676 wrote to memory of 1452	1676	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b16cfd9f3059a80404036d9d4851be86989433cdeecc21639372439be9cc7210.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b16cfd9f3059a80404036d9d4851be86989433cdeecc21639372439be9cc7210.dll,#1
  2⤵
  PID:1452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1452-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download