d0d7149c6124a3bade2a501bff03dfd4f217eac94e874f235c7a9984b2b96e26 | Triage™

Analysis

max time kernel
125s
max time network
11s
platform
windows7_x64
resource
win7v200722
submitted
18/10/2020, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cXQT5g.dll
Size 393KB
Sample201018-jf93ymd5f2
SHA256 d0d7149c6124a3bade2a501bff03dfd4f217eac94e874f235c7a9984b2b96e26
MD5 fa01782a11486c3dfaad36e930d2b9f6
SHA1 05e7c0bd618b04a609df133a29a2d4b41a6b7374
SHA512 47cd0a587dc62b97bfca9d5546f32a9232e86c49d9ff625ede4b53f8a471686fc80de015dda45aab29b04607acfb1f2f99c8febc3188d1eede39e9fc71abf93d
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 1680	336	rundll32.exe	24
PID 336 wrote to memory of 1680	336	rundll32.exe	24
PID 336 wrote to memory of 1680	336	rundll32.exe	24
PID 336 wrote to memory of 1680	336	rundll32.exe	24
PID 336 wrote to memory of 1680	336	rundll32.exe	24
PID 336 wrote to memory of 1680	336	rundll32.exe	24
PID 336 wrote to memory of 1680	336	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cXQT5g.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cXQT5g.dll,#1
  2⤵
  PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads