94ea4614b480418f94bceb76713f109687a6b775244a58d259d34c031e2becf9 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 19:27

Sharing

Report Analysis Logs

General

Target

file.dll
Size

164KB
MD5

271e4cd33c8d55d7117026d6fff1367d
SHA1

a66bed3ebba49b49b9e5b19a576ecce5c739b565
SHA256

94ea4614b480418f94bceb76713f109687a6b775244a58d259d34c031e2becf9
SHA512

bdbbeaf8846798458fe660fce1484ea00b0fba070480eb9dea7f5c8a67733fa4311a43ba2c6c0534c5be22008fda1ac9ec584e79522318fe8ce61d897c945a9c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1904 wrote to memory of 2040	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 2040	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 2040	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 2040	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 2040	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 2040	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 2040	1904	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
2⤵
PID:2040

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-0-0x0000000000000000-mapping.dmp

Download