52f2ed434833d33d042270f665b6e5c08b38fdd8961f7daea60fe6faae786824 | Triage

Analysis

max time kernel
134s
max time network
48s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 05:36

Sharing

Report Analysis Logs

General

Target

update.dll
Size

384KB
MD5

d68ebf37b8aa0b72def326e7cdef09b6
SHA1

3c2f5dfefc7813686e9d29b3d5b06c12a09995f0
SHA256

52f2ed434833d33d042270f665b6e5c08b38fdd8961f7daea60fe6faae786824
SHA512

d09556dc8439b6e77e220f653177e3fd2c71baa8fd795f2a8166bb5f33d2fb81f70988185e67b7620f5010cc763c85e12f83915c92609f1e852bb869469918e6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 744 wrote to memory of 4028	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 4028	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 4028	744	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\update.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\update.dll,#1
2⤵
PID:4028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4028-0-0x0000000000000000-mapping.dmp

Download