b6c99a5ba52fe2ef5b838d580f41a5e4f4c81389dd07bc716593483af33816b9 | Triage

Analysis

max time kernel
128s
max time network
136s
platform
windows7_x64
resource
win7
submitted
09-07-2020 18:39

Sharing

Report Analysis Logs

General

Target

b6c99a5ba52fe2ef5b838d580f41a5e4f4c81389dd07bc716593483af33816b9.dll
Size

785KB
MD5

db5eaf6777c80fb752c19303457cac1d
SHA1

20b60c387bae82c3c24bb668ebd13a1a078c2cf7
SHA256

b6c99a5ba52fe2ef5b838d580f41a5e4f4c81389dd07bc716593483af33816b9
SHA512

31255c6e833aa07cfd3db94df6ae237f56e25a653d0edb636016a406a679400c1edef8d4b13709158c9690385a5220785d0eb11d44e6c7be90a4011a2aad09f8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1512 wrote to memory of 1604	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1604	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1604	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1604	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1604	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1604	1512	rundll32.exe	rundll32.exe
PID 1512 wrote to memory of 1604	1512	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6c99a5ba52fe2ef5b838d580f41a5e4f4c81389dd07bc716593483af33816b9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6c99a5ba52fe2ef5b838d580f41a5e4f4c81389dd07bc716593483af33816b9.dll,#1
2⤵
PID:1604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1604-0-0x0000000000000000-mapping.dmp

Download