c2a4efd5f9ba6f03612eb6e8a324a6721ee84166e50a539f789b3fb6ba9e8399 | Triage

Analysis

max time kernel
4s
max time network
9s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 19:26

Sharing

Report Analysis Logs

General

Target

file.dll
Size

166KB
MD5

08782e0adf1d1ddc94e71cead04c0686
SHA1

a2371f36615b6b5a286d75587606acf9826bc33d
SHA256

c2a4efd5f9ba6f03612eb6e8a324a6721ee84166e50a539f789b3fb6ba9e8399
SHA512

122a32536e4fdb5ab639de00a88b5938fedcbc0c0451bb33d03c9780444bbf98ab3de1f5a9d4418a8d4e7f949c932dd7f0cb81ed03646fb6ccee1092e063d427

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1584 wrote to memory of 1184	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1184	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1184	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1184	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1184	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1184	1584	rundll32.exe	rundll32.exe
PID 1584 wrote to memory of 1184	1584	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
2⤵
PID:1184

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-0-0x0000000000000000-mapping.dmp

Download