6f6d4f3090669a12b7870d959302181d721436520374a4115e6c7bcfbc21cfef | Triage

Analysis

max time kernel
6s
max time network
15s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 19:27

Sharing

Report Analysis Logs

General

Target

file.dll
Size

166KB
MD5

0f8ee1ed415794ec053dca928a409436
SHA1

816810ed34af4cb460c36b76b6dc614be05b4d99
SHA256

6f6d4f3090669a12b7870d959302181d721436520374a4115e6c7bcfbc21cfef
SHA512

4ad3f0bdaf1121612b102e871ae12562fe765d00e3ab3cc77ee773c78a09cc8c9ebfeaabb15dde38a2df2f73be2338b93028d95ca003bd39556f1190f6108727

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1684 wrote to memory of 2036	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2036	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2036	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2036	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2036	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2036	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2036	1684	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
2⤵
PID:2036

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-0-0x0000000000000000-mapping.dmp

Download