5537e2cb1fc20798964872518e4d8eded7f85f28b9e59b3ccfdbcbe9e27c91d1 | Triage

Analysis

max time kernel
36s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:56

Sharing

Report Analysis Logs

General

Target

5537e2cb1fc20798964872518e4d8eded7f85f28b9e59b3ccfdbcbe9e27c91d1.dll
Size

3KB
MD5

affeec6461f6443001937144c3d65190
SHA1

2a840e2951b4a9ca3dc58e51f2f45d1c221c807d
SHA256

5537e2cb1fc20798964872518e4d8eded7f85f28b9e59b3ccfdbcbe9e27c91d1
SHA512

ede30ee4cf66b3041ccdc041864baad77328ead92ac02324ba72c7e458536cee3541c9eb775505403bcea33f7654bb4618e3cf996334d66cd99e35c78cf7b814

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 916	880	rundll32.exe	27
PID 880 wrote to memory of 916	880	rundll32.exe	27
PID 880 wrote to memory of 916	880	rundll32.exe	27
PID 880 wrote to memory of 916	880	rundll32.exe	27
PID 880 wrote to memory of 916	880	rundll32.exe	27
PID 880 wrote to memory of 916	880	rundll32.exe	27
PID 880 wrote to memory of 916	880	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5537e2cb1fc20798964872518e4d8eded7f85f28b9e59b3ccfdbcbe9e27c91d1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5537e2cb1fc20798964872518e4d8eded7f85f28b9e59b3ccfdbcbe9e27c91d1.dll,#1
  2⤵
  PID:916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-55-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download