78848ecbc201d7186de2db11a95b8cbd7509791196034b74f0118c77c1451e79 | Triage

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:22

Sharing

Report Analysis Logs

General

Target

78848ecbc201d7186de2db11a95b8cbd7509791196034b74f0118c77c1451e79.dll
Size

3KB
MD5

c80075cdadd83a0f6b8959b51e659090
SHA1

f0a8014ad0c35e2087eff55001a2b57dcaff80ad
SHA256

78848ecbc201d7186de2db11a95b8cbd7509791196034b74f0118c77c1451e79
SHA512

26260bb1305e7ddfc51266727dd9ae0b4757fff42f36bab999dfcc33caf65a1b84e5fcf31062f61e89c1925637b581b67f4a48d283bf5e039e6a1e0484c36b78

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78848ecbc201d7186de2db11a95b8cbd7509791196034b74f0118c77c1451e79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78848ecbc201d7186de2db11a95b8cbd7509791196034b74f0118c77c1451e79.dll,#1
  2⤵
  PID:1852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1852-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download