5690751f95eaedfa3752362176c6f2886ca05153c837634d4d04e4452c92a82e | Triage

Analysis

max time kernel
37s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 01:30

Sharing

Report Analysis Logs

General

Target

5690751f95eaedfa3752362176c6f2886ca05153c837634d4d04e4452c92a82e.dll
Size

3KB
MD5

8a9ea7004836fb63e7a1033306bd09f0
SHA1

9ab789bab08df7ea9357e178c7477524867519c2
SHA256

5690751f95eaedfa3752362176c6f2886ca05153c837634d4d04e4452c92a82e
SHA512

b51b045fab720688612e34862269992ebdbccbd5dfe29401f8b62caf4029b561b10c1d0239f0fadc5df2a15804c033081c03e4fed9cdfe23f47fb53ac6840ee7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1000	1488	rundll32.exe	28
PID 1488 wrote to memory of 1000	1488	rundll32.exe	28
PID 1488 wrote to memory of 1000	1488	rundll32.exe	28
PID 1488 wrote to memory of 1000	1488	rundll32.exe	28
PID 1488 wrote to memory of 1000	1488	rundll32.exe	28
PID 1488 wrote to memory of 1000	1488	rundll32.exe	28
PID 1488 wrote to memory of 1000	1488	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5690751f95eaedfa3752362176c6f2886ca05153c837634d4d04e4452c92a82e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5690751f95eaedfa3752362176c6f2886ca05153c837634d4d04e4452c92a82e.dll,#1
  2⤵
  PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download