ac51558d7ed38b08f91d2f1ce0573a1153a1666cb3584fb1bd38c4b842f05404 | Triage

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:52

Sharing

Report Analysis Logs

General

Target

ac51558d7ed38b08f91d2f1ce0573a1153a1666cb3584fb1bd38c4b842f05404.dll
Size

3KB
MD5

a83a9a34344f9edf4d517d4207a29bc0
SHA1

2959ff16428ea9ba75f6744745d61afe9f63a0f1
SHA256

ac51558d7ed38b08f91d2f1ce0573a1153a1666cb3584fb1bd38c4b842f05404
SHA512

56860584f49b7ba9c441d135f5acd729fbe9bd0e86873754eb77076a04c7e9135f9426fbc471179d1bbe2addf1bd134816e337aab8f0b1654c4e6fff12d4ddfa

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1368	1044	rundll32.exe	28
PID 1044 wrote to memory of 1368	1044	rundll32.exe	28
PID 1044 wrote to memory of 1368	1044	rundll32.exe	28
PID 1044 wrote to memory of 1368	1044	rundll32.exe	28
PID 1044 wrote to memory of 1368	1044	rundll32.exe	28
PID 1044 wrote to memory of 1368	1044	rundll32.exe	28
PID 1044 wrote to memory of 1368	1044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac51558d7ed38b08f91d2f1ce0573a1153a1666cb3584fb1bd38c4b842f05404.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac51558d7ed38b08f91d2f1ce0573a1153a1666cb3584fb1bd38c4b842f05404.dll,#1
  2⤵
  PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download