873aa376573288fcf56711b5689f9d2cf457b76bbc93d4e40ef9d7a27b7be466 | Triage

Analysis

max time kernel
114s
max time network
121s
platform
windows7_x64
resource
win7
submitted
09-07-2020 07:38

Sharing

Report Analysis Logs

General

Target

megacortex_ics.bin.dll
Size

727KB
MD5

53dddbb304c79ae293f98e0b151c6b28
SHA1

2632529b0fb7ed46461c406f733c047a6cd4c591
SHA256

873aa376573288fcf56711b5689f9d2cf457b76bbc93d4e40ef9d7a27b7be466
SHA512

a31238a5f8ade0e5e1685ceb29d6106e7f1bc4cfc4dfe7d15732260ceb3fae4855205ae127f46031b4d4333e1d441909498a2bf8dcf2c30c8871c448e84a1882

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 608 wrote to memory of 1184	608	rundll32.exe	rundll32.exe
PID 608 wrote to memory of 1184	608	rundll32.exe	rundll32.exe
PID 608 wrote to memory of 1184	608	rundll32.exe	rundll32.exe
PID 608 wrote to memory of 1184	608	rundll32.exe	rundll32.exe
PID 608 wrote to memory of 1184	608	rundll32.exe	rundll32.exe
PID 608 wrote to memory of 1184	608	rundll32.exe	rundll32.exe
PID 608 wrote to memory of 1184	608	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\megacortex_ics.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:608

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\megacortex_ics.bin.dll,#1
2⤵
PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-0-0x0000000000000000-mapping.dmp

Download