97c6fdb81fcc7d56b44c314ad21d2ef5e85299e18cff95cebc54b9192c025902 | Triage

Analysis

max time kernel
130s
max time network
137s
platform
windows7_x64
resource
win7
submitted
08/07/2020, 05:40

Sharing

Report Analysis Logs

General

Target

update .dll
Size

384KB
MD5

f93a2db1e096cc876b72aeaae82451f9
SHA1

903440d349190360ce0fc84bd6c32f3e9a95a02c
SHA256

97c6fdb81fcc7d56b44c314ad21d2ef5e85299e18cff95cebc54b9192c025902
SHA512

b075206e4897a0d3233db94863acbd8ac7592a11489a55fa892c11732b6948143805d090b71b04e0ab8dc98000c7494a2d2c98982d3fd980b9bef8ef5ae6353c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1064	1060	rundll32.exe	24
PID 1060 wrote to memory of 1064	1060	rundll32.exe	24
PID 1060 wrote to memory of 1064	1060	rundll32.exe	24
PID 1060 wrote to memory of 1064	1060	rundll32.exe	24
PID 1060 wrote to memory of 1064	1060	rundll32.exe	24
PID 1060 wrote to memory of 1064	1060	rundll32.exe	24
PID 1060 wrote to memory of 1064	1060	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\update .dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\update .dll",#1
  2⤵
  PID:1064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads