c40dfd58e6da0aade75d09b6a659cf165f072ba89aef2d60c10c153793535ee7 | Triage

Analysis

max time kernel
12s
max time network
12s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 19:27

Sharing

Report Analysis Logs

General

Target

file.dll
Size

166KB
MD5

b979913c1157d8e0e1066afbd296e3f3
SHA1

1016b7581ea09468b93cf635dbe0ff760bcf1428
SHA256

c40dfd58e6da0aade75d09b6a659cf165f072ba89aef2d60c10c153793535ee7
SHA512

709acfdb81e5eaf00affadc74939935d8af36d061ad02fa7626db89a5a55b95dcd9c13a38f5205ab19d91e2abd30c856d67dfdd4257438f6ce6b9662e5781d53

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 844 wrote to memory of 1592	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1592	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1592	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1592	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1592	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1592	844	rundll32.exe	rundll32.exe
PID 844 wrote to memory of 1592	844	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
2⤵
PID:1592

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1592-0-0x0000000000000000-mapping.dmp

Download