7e7edb63b2dd35481b73828564d123d6b8873a3a3cef8767ce3b0a9df89cc336 | Triage

Analysis

max time kernel
3s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 19:27

Sharing

Report Analysis Logs

General

Target

file.dll
Size

164KB
MD5

abef8df26fea0f7485527eb8a3171364
SHA1

ea33000bb357c43291ae3f1227b17c5cd8c99251
SHA256

7e7edb63b2dd35481b73828564d123d6b8873a3a3cef8767ce3b0a9df89cc336
SHA512

0b2b335336183ae606e460a7c38013281056da24a94bb473e778d221e4c0c90ed39ab8251ea775ed3e252267c18372c7fff69186454c3c4b3fb4fec46f563ab9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1588 wrote to memory of 1640	1588	rundll32.exe	rundll32.exe
PID 1588 wrote to memory of 1640	1588	rundll32.exe	rundll32.exe
PID 1588 wrote to memory of 1640	1588	rundll32.exe	rundll32.exe
PID 1588 wrote to memory of 1640	1588	rundll32.exe	rundll32.exe
PID 1588 wrote to memory of 1640	1588	rundll32.exe	rundll32.exe
PID 1588 wrote to memory of 1640	1588	rundll32.exe	rundll32.exe
PID 1588 wrote to memory of 1640	1588	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
2⤵
PID:1640

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-0-0x0000000000000000-mapping.dmp

Download