f3a538a0a43dc9a99a00e760764a0d43517beb25e832e763538ed29b5a9db058 | Triage™

Analysis

max time kernel
12s
max time network
153s
platform
windows7_x64
resource
win7v200722
submitted
07/10/2020, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fa7ad76b346b6cd410c3d53616cf28e8.dll
Size 429KB
Sample201007-25nblkkhva
SHA256 f3a538a0a43dc9a99a00e760764a0d43517beb25e832e763538ed29b5a9db058
MD5 fa7ad76b346b6cd410c3d53616cf28e8
SHA1 4c3a5c1779676758b7f736f5c2fd2cdcd6e31b47
SHA512 dd404f992f6c55e419ced29e339645208f60453b6f476075c729f5e6d55d436712b7088a2eaf50de9c46d17c838510593eb34270fad4209bf7bf6dbb261a360c
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1792	748	rundll32.exe	24
PID 748 wrote to memory of 1792	748	rundll32.exe	24
PID 748 wrote to memory of 1792	748	rundll32.exe	24
PID 748 wrote to memory of 1792	748	rundll32.exe	24
PID 748 wrote to memory of 1792	748	rundll32.exe	24
PID 748 wrote to memory of 1792	748	rundll32.exe	24
PID 748 wrote to memory of 1792	748	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa7ad76b346b6cd410c3d53616cf28e8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa7ad76b346b6cd410c3d53616cf28e8.dll,#1
  2⤵
  PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads