d5404d14fc0592731b61010caca278cc65e9a35f096939432f303c2b7d92c3b7 | Triage™

Analysis

max time kernel
115s
max time network
121s
platform
windows10_x64
resource
win10
submitted
17/07/2020, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ebcd0a0d92f5efef88196a9ca6e1936cf331d9789f4d8cca6506131fcf921cbf_3.dll
Size 67KB
Sample200717-d83fpwtrwj
SHA256 d5404d14fc0592731b61010caca278cc65e9a35f096939432f303c2b7d92c3b7
MD5 da79de77d70a8f07484011e187e0c822
SHA1 2cf15ffec3b2d97b09d093b3dc7999b9b9191058
SHA512 15000d1e13085c2b6c8089f0db418d4c9c627c99fd417440b8bf2308f659ed5d8ea12e28fafdeefb8a8e3cab2e9a69d7fbec7008865bb7ddcee0e09cb96b47a1
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 3864	3404	rundll32.exe	67
PID 3404 wrote to memory of 3864	3404	rundll32.exe	67
PID 3404 wrote to memory of 3864	3404	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebcd0a0d92f5efef88196a9ca6e1936cf331d9789f4d8cca6506131fcf921cbf_3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebcd0a0d92f5efef88196a9ca6e1936cf331d9789f4d8cca6506131fcf921cbf_3.dll,#1
  2⤵
  PID:3864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads