d5471d9c9f47e7cf08e3f7d49815e5afa2db5754a337a56e8ec5c8591bc16f07 | Triage™

Analysis

max time kernel
9s
max time network
18s
platform
windows7_x64
resource
win7v200722
submitted
19/10/2020, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
76e463dfe11395e20529c62d32f06a17.dll
Size 15KB
Sample201019-cdzry9ac8j
SHA256 d5471d9c9f47e7cf08e3f7d49815e5afa2db5754a337a56e8ec5c8591bc16f07
MD5 76e463dfe11395e20529c62d32f06a17
SHA1 560d7edaf2bce8347423a8b20992019f24b88c2e
SHA512 98b9edd8d8a12e4201682c692be15de76fe17a43aa9844a95cab02fea54bac401d79820402ec98e52358b7f1c2f2e99857bc236821277e370b043a44c83948e2
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1836	1516	rundll32.exe	24
PID 1516 wrote to memory of 1836	1516	rundll32.exe	24
PID 1516 wrote to memory of 1836	1516	rundll32.exe	24
PID 1516 wrote to memory of 1836	1516	rundll32.exe	24
PID 1516 wrote to memory of 1836	1516	rundll32.exe	24
PID 1516 wrote to memory of 1836	1516	rundll32.exe	24
PID 1516 wrote to memory of 1836	1516	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76e463dfe11395e20529c62d32f06a17.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76e463dfe11395e20529c62d32f06a17.dll,#1
  2⤵
  PID:1836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads