149a36db6fb24430e47be5f322c2bc5df212ce0dbf4a9232f97b0420fa0531c9 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-01-2023 08:20

Sharing

Report Analysis Logs

General

Target

10000000.dll
Size

88KB
MD5

da3662d8691f4614bcbd167432d86d9d
SHA1

6f7d7d91487c19655416fe1c1439bf7543ab1532
SHA256

149a36db6fb24430e47be5f322c2bc5df212ce0dbf4a9232f97b0420fa0531c9
SHA512

248ba777d2a219d266d4ed0b153f51528bd796bd78df53b4e42e4f971b42cf03dd3cb5a67158f943670caaa40dc81c4a77ec598af453fd0bdae43b74f35d2eda
SSDEEP

1536:NUnHoChp3eiFgkrxWvaJPL/bh8+hVQDf/zvHns:NwICzPrxrt8smzvs

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1112 wrote to memory of 1136	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1136	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1136	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1136	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1136	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1136	1112	rundll32.exe	rundll32.exe
PID 1112 wrote to memory of 1136	1112	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10000000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10000000.dll,#1
2⤵
PID:1136

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-54-0x0000000000000000-mapping.dmp

Download
memory/1136-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download