71ec3300b43a77f47d8744555809dbb18f0f0a30811e078da593b4bae8c9e2cf | Triage

Analysis

max time kernel
32s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:55

Sharing

Report Analysis Logs

General

Target

71ec3300b43a77f47d8744555809dbb18f0f0a30811e078da593b4bae8c9e2cf.dll
Size

3KB
MD5

f8f78ed4b17142e5129a0e8469cdd4c0
SHA1

f4b343dce1a19bb5ba63f733d3ff75a281c34ee5
SHA256

71ec3300b43a77f47d8744555809dbb18f0f0a30811e078da593b4bae8c9e2cf
SHA512

8c61653f141ab7f20243e6935cddb440b1d4decdabeb550123b3a0a1097d2b851f1b6bc74ceeefd26ef5559d84156c157631ef19c8cfdc8f48a1b3b7f3f55ffd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1284	1972	rundll32.exe	28
PID 1972 wrote to memory of 1284	1972	rundll32.exe	28
PID 1972 wrote to memory of 1284	1972	rundll32.exe	28
PID 1972 wrote to memory of 1284	1972	rundll32.exe	28
PID 1972 wrote to memory of 1284	1972	rundll32.exe	28
PID 1972 wrote to memory of 1284	1972	rundll32.exe	28
PID 1972 wrote to memory of 1284	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71ec3300b43a77f47d8744555809dbb18f0f0a30811e078da593b4bae8c9e2cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\71ec3300b43a77f47d8744555809dbb18f0f0a30811e078da593b4bae8c9e2cf.dll,#1
  2⤵
  PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download