fff929c4f44411e0f8da272f8d1db4593b23acd3c52cf8958792aef9548b4623 | Triage

Resubmissions

05-10-2020 07:08

201005-bhtdb4h2c2 1

04-10-2020 14:06

201004-tfw8b3ehm2 1

Analysis

max time kernel
16s
max time network
112s
platform
windows10_x64
resource
win10v200722
submitted
04-10-2020 14:06

Sharing

Report Analysis Logs

General

Target

fff929c4f44411e0f8da272f8d1db4593b23acd3c52cf8958792aef9548b4623.dll
Size

839KB
MD5

6aee58b63843a0d73a98a2922092de8a
SHA1

abc6ac9a98360aa065f32e15d0a9293f8aa26e32
SHA256

fff929c4f44411e0f8da272f8d1db4593b23acd3c52cf8958792aef9548b4623
SHA512

ab93f97b94953edc7d051ffa48cf444d4f09af479746ad88b86907e50d8984919fa1fdef473b2cb73adcb23378c03a81a06eece1cf7b1d12a469c0eec943d20c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 508 wrote to memory of 1000	508	rundll32.exe	rundll32.exe
PID 508 wrote to memory of 1000	508	rundll32.exe	rundll32.exe
PID 508 wrote to memory of 1000	508	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fff929c4f44411e0f8da272f8d1db4593b23acd3c52cf8958792aef9548b4623.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:508

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fff929c4f44411e0f8da272f8d1db4593b23acd3c52cf8958792aef9548b4623.dll,#1
2⤵
PID:1000

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-0-0x0000000000000000-mapping.dmp

Download