ebcd0a0d92f5efef88196a9ca6e1936cf331d9789f4d8cca6506131fcf921cbf | Triage

Analysis

max time kernel
114s
max time network
120s
platform
windows7_x64
resource
win7
submitted
16-07-2020 14:15

Sharing

Report Analysis Logs

General

Target

McUtil.dll
Size

194KB
MD5

6063c554b64ca357064f59ca172e047d
SHA1

040ae092a0ab8801a92c4d0d533a03ce13595e1f
SHA256

ebcd0a0d92f5efef88196a9ca6e1936cf331d9789f4d8cca6506131fcf921cbf
SHA512

eb4a932efaa1f2bd5fe299392049214bc8d78dfdf6f25901cfb355913f9dd1a6023fb131ad49ebdcf6d16da7f156a81d45b5770727125b6d018e2abaa530a908

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 1184	608	rundll32.exe	24
PID 608 wrote to memory of 1184	608	rundll32.exe	24
PID 608 wrote to memory of 1184	608	rundll32.exe	24
PID 608 wrote to memory of 1184	608	rundll32.exe	24
PID 608 wrote to memory of 1184	608	rundll32.exe	24
PID 608 wrote to memory of 1184	608	rundll32.exe	24
PID 608 wrote to memory of 1184	608	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\McUtil.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\McUtil.dll,#1
  2⤵
  PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads