9b233994400898091ccf11650beeab0d234ca3c9c5472dcbaa95360eb14d5516 | Triage

Analysis

max time kernel
130s
max time network
136s
platform
windows7_x64
resource
win7
submitted
09/07/2020, 08:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a6113e8a0387832bd3b05a6f3e70c2cc.exe.dll
Size

207KB
MD5

87a41e0d6e797735e64d97d212822385
SHA1

7c1730296e69ead34e5642f284b86eebc87632a5
SHA256

9b233994400898091ccf11650beeab0d234ca3c9c5472dcbaa95360eb14d5516
SHA512

f1df064842a028af7b3325026638a6b2faf720de0d9330debe6045484af5595a4b9476a57ef20d3e817c457f2f4e7be0b5c9cea5873470d5d1d7d7feb0098208

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 1184	608	rundll32.exe	24
PID 608 wrote to memory of 1184	608	rundll32.exe	24
PID 608 wrote to memory of 1184	608	rundll32.exe	24
PID 608 wrote to memory of 1184	608	rundll32.exe	24
PID 608 wrote to memory of 1184	608	rundll32.exe	24
PID 608 wrote to memory of 1184	608	rundll32.exe	24
PID 608 wrote to memory of 1184	608	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6113e8a0387832bd3b05a6f3e70c2cc.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6113e8a0387832bd3b05a6f3e70c2cc.exe.dll,#1
  2⤵
  PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads