Analysis
-
max time kernel
17s -
max time network
111s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
06-10-2020 21:36
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BScope.Trojan.Diple.23366.dll
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.BScope.Trojan.Diple.23366.dll
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.BScope.Trojan.Diple.23366.dll
-
Size
429KB
-
MD5
5cf26b8152b725eef68a7c7c4a0ce1a9
-
SHA1
e119cfa624d2373d0c35930e0c682100b0d092b4
-
SHA256
0c706ecdd8cb4393779872471c38ad5286f4883107e75835a91f007815e7413a
-
SHA512
cd5d285c9ffbfbad71055913d8b2167e90857cae1e4f0af4c32ca938d0209da1ff5c96780a362650b2b9f5616f4edd4ec3687b3125385531fc48cf44e001b1e2
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 496 wrote to memory of 1116 496 rundll32.exe rundll32.exe PID 496 wrote to memory of 1116 496 rundll32.exe rundll32.exe PID 496 wrote to memory of 1116 496 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.Trojan.Diple.23366.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.Trojan.Diple.23366.dll,#12⤵PID:1116
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1116-0-0x0000000000000000-mapping.dmp