97c6fdb81fcc7d56b44c314ad21d2ef5e85299e18cff95cebc54b9192c025902 | Triage

Analysis

max time kernel
137s
max time network
139s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 05:40

Sharing

Report Analysis Logs

General

Target

update .dll
Size

384KB
MD5

f93a2db1e096cc876b72aeaae82451f9
SHA1

903440d349190360ce0fc84bd6c32f3e9a95a02c
SHA256

97c6fdb81fcc7d56b44c314ad21d2ef5e85299e18cff95cebc54b9192c025902
SHA512

b075206e4897a0d3233db94863acbd8ac7592a11489a55fa892c11732b6948143805d090b71b04e0ab8dc98000c7494a2d2c98982d3fd980b9bef8ef5ae6353c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 812	2804	rundll32.exe	66
PID 2804 wrote to memory of 812	2804	rundll32.exe	66
PID 2804 wrote to memory of 812	2804	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\update .dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\update .dll",#1
  2⤵
  PID:812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads