Analysis
-
max time kernel
132s -
max time network
31s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
07-07-2020 05:47
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Johnnie.216272.15435.3771.dll
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Variant.Johnnie.216272.15435.3771.dll
Resource
win10
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.Variant.Johnnie.216272.15435.3771.dll
-
Size
532KB
-
MD5
d0f8531ec645191396671e3f832bb498
-
SHA1
9e02272de43ecdafd4fe3b993acceaefb403f473
-
SHA256
c43ac92a424c154cc3dfa3a7558dc3040ed5feedd24a89471b93fbe8f27bf66b
-
SHA512
bc515302aa9a48429f984e89392c34489944a49e84fecd0dab31fb4a5a968583728a949d24375c493d357ce5f66cb12ae9be209742ff8ecc462756048a98ec49
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1604 wrote to memory of 1056 1604 rundll32.exe rundll32.exe PID 1604 wrote to memory of 1056 1604 rundll32.exe rundll32.exe PID 1604 wrote to memory of 1056 1604 rundll32.exe rundll32.exe PID 1604 wrote to memory of 1056 1604 rundll32.exe rundll32.exe PID 1604 wrote to memory of 1056 1604 rundll32.exe rundll32.exe PID 1604 wrote to memory of 1056 1604 rundll32.exe rundll32.exe PID 1604 wrote to memory of 1056 1604 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Johnnie.216272.15435.3771.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Johnnie.216272.15435.3771.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1056-0-0x0000000000000000-mapping.dmp