d06d675add136cc82c55c68166df534afa018e9f1ae333a9a75cacc1ec66d9d3 | Triage

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7
submitted
07/07/2020, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.GenericKD.42681420.1031.32076.dll
Size

442KB
MD5

1bca22547678b00aa2227b45cfeec4fd
SHA1

bbd3a4ce33ccb450dbc6516e88791c7e82b526c4
SHA256

d06d675add136cc82c55c68166df534afa018e9f1ae333a9a75cacc1ec66d9d3
SHA512

09dc8f05050dba937bf0c8b45348ba503977876389a1e65880890a2f348886366b172bf6f67dfa874071d96ef9727781fc2b6d02d7ad8d8ba154a6b0d7dee48a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 836	900	rundll32.exe	24
PID 900 wrote to memory of 836	900	rundll32.exe	24
PID 900 wrote to memory of 836	900	rundll32.exe	24
PID 900 wrote to memory of 836	900	rundll32.exe	24
PID 900 wrote to memory of 836	900	rundll32.exe	24
PID 900 wrote to memory of 836	900	rundll32.exe	24
PID 900 wrote to memory of 836	900	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.42681420.1031.32076.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.42681420.1031.32076.dll,#1
  2⤵
  PID:836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads