c43ac92a424c154cc3dfa3a7558dc3040ed5feedd24a89471b93fbe8f27bf66b | Triage

Analysis

max time kernel
132s
max time network
31s
platform
windows7_x64
resource
win7v200430
submitted
07-07-2020 05:47

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Variant.Johnnie.216272.15435.3771.dll
Size

532KB
MD5

d0f8531ec645191396671e3f832bb498
SHA1

9e02272de43ecdafd4fe3b993acceaefb403f473
SHA256

c43ac92a424c154cc3dfa3a7558dc3040ed5feedd24a89471b93fbe8f27bf66b
SHA512

bc515302aa9a48429f984e89392c34489944a49e84fecd0dab31fb4a5a968583728a949d24375c493d357ce5f66cb12ae9be209742ff8ecc462756048a98ec49

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1604 wrote to memory of 1056	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1056	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1056	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1056	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1056	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1056	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1056	1604	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Johnnie.216272.15435.3771.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Johnnie.216272.15435.3771.dll,#1
2⤵
PID:1056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-0-0x0000000000000000-mapping.dmp

Download