daf5fb094685e539b734678789da31bb003a3e4000a29c651d6bf93483fdc021 | Triage

Analysis

max time kernel
114s
max time network
121s
platform
windows7_x64
resource
win7
submitted
07-07-2020 15:05

Sharing

Report Analysis Logs

General

Target

C.dll
Size

36KB
MD5

c39c2a20e5ebab0a4db1e58f192ecc5e
SHA1

b15bd3a54b07ff4cb42bdc1e9de98ca511488ecf
SHA256

daf5fb094685e539b734678789da31bb003a3e4000a29c651d6bf93483fdc021
SHA512

3faacf3c433bf8cb05125f9a9e356ed070de5bec5a221d3a95a6db1a8628ebc5082c3e5785900c71c0c3cf1c866e8b5b893fe5c4d076b8787f372c2e88662ed5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1124 wrote to memory of 1072	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 1072	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 1072	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 1072	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 1072	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 1072	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 1072	1124	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\C.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\C.dll,#1
2⤵
PID:1072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-1-0x0000000000000000-mapping.dmp

Download
memory/1124-0-0x0000000000110000-0x0000000000112000-memory.dmp

Filesize
8KB

Download