b927203812bd5776ed375a59e3131046750b5050b3847bf79f61a491026f1b25 | Triage

Analysis

max time kernel
3s
max time network
12s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 19:27

Sharing

Report Analysis Logs

General

Target

file.dll
Size

164KB
MD5

d468499ca5f8d8f528920635e89ab3f2
SHA1

ce1db497eef5371e20a8600281672ca21c662a7d
SHA256

b927203812bd5776ed375a59e3131046750b5050b3847bf79f61a491026f1b25
SHA512

2232c6badf61f2db66a0a7e4173534eb3aa1415efc851ee9d77b2bb6aa67933c0b6bb97a17d0b155fb608b84950bf51c9f189cd072ebbb683c7cf4cf5808b3a9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1744 wrote to memory of 1260	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1260	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1260	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1260	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1260	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1260	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1260	1744	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
2⤵
PID:1260

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-0-0x0000000000000000-mapping.dmp

Download