Analysis

  • max time kernel
    27s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2022, 22:58

General

  • Target

    1836-57-0x00000000001A0000-0x00000000001C2000-memory.dll

  • Size

    136KB

  • MD5

    39e5cef043c74bf0bd7934473183c875

  • SHA1

    2676d026a80164dcd7c74e41cbe8d36fe2047589

  • SHA256

    2c6b20c6229c16387bb4575d6073c244d7e525c4a2ac7a15f9c7e8b03aee3b34

  • SHA512

    66ac9951edd48e327d33d0d05f9e0cbe3e85ea13071027951fb10e773157d9579f3c9807c128f4b643035a8f470efa6d252b78513ec3f16d80c258fb5ef99149

  • SSDEEP

    1536:aM9LZf1VURCxABUxCJYmn0oKgk48mz0orNf2BAzRyJNIuYS/IOg6nToIfV/oegrY:aM9m1jBKx4Xz0auAQJyu3xNTBfVgeJh

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1836-57-0x00000000001A0000-0x00000000001C2000-memory.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\1836-57-0x00000000001A0000-0x00000000001C2000-memory.dll,#1
      2⤵
        PID:1260

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1260-55-0x00000000753F1000-0x00000000753F3000-memory.dmp

            Filesize

            8KB