747215655246587e4db7d04356ca00afa7fbe25b7fd1f3ba4f182670a9b86519 | Triage

Analysis

max time kernel
4s
max time network
13s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 19:27

Sharing

Report Analysis Logs

General

Target

file.dll
Size

164KB
MD5

8afd4dcef4e3dcef755ecb2a996959ea
SHA1

803e092fe8612172bdad5111c7f783e81d55ed7b
SHA256

747215655246587e4db7d04356ca00afa7fbe25b7fd1f3ba4f182670a9b86519
SHA512

27724aa4f1c4ec52fd56b4422bcaa5dfe73ecbe1a2f174c3695923e1717f831e32e6349b1c37848788ce6d8e22f4bda9ee73aab1df2a794eeda13b81f46610a9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1068 wrote to memory of 1544	1068	rundll32.exe	rundll32.exe
PID 1068 wrote to memory of 1544	1068	rundll32.exe	rundll32.exe
PID 1068 wrote to memory of 1544	1068	rundll32.exe	rundll32.exe
PID 1068 wrote to memory of 1544	1068	rundll32.exe	rundll32.exe
PID 1068 wrote to memory of 1544	1068	rundll32.exe	rundll32.exe
PID 1068 wrote to memory of 1544	1068	rundll32.exe	rundll32.exe
PID 1068 wrote to memory of 1544	1068	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
2⤵
PID:1544

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-0-0x0000000000000000-mapping.dmp

Download