ebcd0a0d92f5efef88196a9ca6e1936cf331d9789f4d8cca6506131fcf921cbf | Triage

Analysis

max time kernel
135s
max time network
48s
platform
windows10_x64
resource
win10v200430
submitted
16/07/2020, 14:15

Sharing

Report Analysis Logs

General

Target

McUtil.dll
Size

194KB
MD5

6063c554b64ca357064f59ca172e047d
SHA1

040ae092a0ab8801a92c4d0d533a03ce13595e1f
SHA256

ebcd0a0d92f5efef88196a9ca6e1936cf331d9789f4d8cca6506131fcf921cbf
SHA512

eb4a932efaa1f2bd5fe299392049214bc8d78dfdf6f25901cfb355913f9dd1a6023fb131ad49ebdcf6d16da7f156a81d45b5770727125b6d018e2abaa530a908

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 4036	896	rundll32.exe	66
PID 896 wrote to memory of 4036	896	rundll32.exe	66
PID 896 wrote to memory of 4036	896	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\McUtil.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\McUtil.dll,#1
  2⤵
  PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads