8c32012baa74c8ee1bf676094f688505eae215317cc38c0e28a518e5a9d0b70b | Triage

Analysis

max time kernel
3s
max time network
17s
platform
windows7_x64
resource
win7
submitted
03-10-2020 07:22

Sharing

Report Analysis Logs

General

Target

LbYesiVe.exe.dll
Size

116KB
MD5

284281286455371cf12b69ad76034d08
SHA1

9cee17cf7463f677555ccbd1cc2e574ea7e74a31
SHA256

8c32012baa74c8ee1bf676094f688505eae215317cc38c0e28a518e5a9d0b70b
SHA512

e1ac523859e197594c89937a88d9c556041a5965e0a4b2f52fb602a0dee2ab990c00a1912e40d115c4164016a43a2d7b24a8a07f095dbee51393c113f5c04918

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 284 wrote to memory of 1616	284	rundll32.exe	rundll32.exe
PID 284 wrote to memory of 1616	284	rundll32.exe	rundll32.exe
PID 284 wrote to memory of 1616	284	rundll32.exe	rundll32.exe
PID 284 wrote to memory of 1616	284	rundll32.exe	rundll32.exe
PID 284 wrote to memory of 1616	284	rundll32.exe	rundll32.exe
PID 284 wrote to memory of 1616	284	rundll32.exe	rundll32.exe
PID 284 wrote to memory of 1616	284	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LbYesiVe.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:284

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LbYesiVe.exe.dll,#1
2⤵
PID:1616

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-0-0x0000000000000000-mapping.dmp

Download