d0d7149c6124a3bade2a501bff03dfd4f217eac94e874f235c7a9984b2b96e26 | Triage™

Analysis

max time kernel
86s
max time network
152s
platform
windows10_x64
resource
win10
submitted
18/10/2020, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cXQT5g.dll
Size 393KB
Sample201018-jf93ymd5f2
SHA256 d0d7149c6124a3bade2a501bff03dfd4f217eac94e874f235c7a9984b2b96e26
MD5 fa01782a11486c3dfaad36e930d2b9f6
SHA1 05e7c0bd618b04a609df133a29a2d4b41a6b7374
SHA512 47cd0a587dc62b97bfca9d5546f32a9232e86c49d9ff625ede4b53f8a471686fc80de015dda45aab29b04607acfb1f2f99c8febc3188d1eede39e9fc71abf93d
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 3648	3844	rundll32.exe	68
PID 3844 wrote to memory of 3648	3844	rundll32.exe	68
PID 3844 wrote to memory of 3648	3844	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cXQT5g.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cXQT5g.dll,#1
  2⤵
  PID:3648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads