622f15c89f1c0afaeacdf9672926967820a71c8ef1dbb3e39b28bbb9f238e0b5 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 22:04

Sharing

Report Analysis Logs

General

Target

622f15c89f1c0afaeacdf9672926967820a71c8ef1dbb3e39b28bbb9f238e0b5.dll
Size

3KB
MD5

7be580defb0770da72458a0544047bd1
SHA1

0b4d603e373604547c49c799463a840998570cd0
SHA256

622f15c89f1c0afaeacdf9672926967820a71c8ef1dbb3e39b28bbb9f238e0b5
SHA512

be64671d2203a301646f3633e68b45c7efd7837810f9a9bf9b2a9a0f1f83d5886b0d2a17ba07f198ac9106df5d6b9a7803c94340b5b4b963d1cca0462aa3f97d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1672	2220	rundll32.exe	28
PID 2220 wrote to memory of 1672	2220	rundll32.exe	28
PID 2220 wrote to memory of 1672	2220	rundll32.exe	28
PID 2220 wrote to memory of 1672	2220	rundll32.exe	28
PID 2220 wrote to memory of 1672	2220	rundll32.exe	28
PID 2220 wrote to memory of 1672	2220	rundll32.exe	28
PID 2220 wrote to memory of 1672	2220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\622f15c89f1c0afaeacdf9672926967820a71c8ef1dbb3e39b28bbb9f238e0b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\622f15c89f1c0afaeacdf9672926967820a71c8ef1dbb3e39b28bbb9f238e0b5.dll,#1
  2⤵
  PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads