c35f35a9e54f35375bc2f72842d038c4121a5cc6314ac7cbabca6a8dc463cfcd | Triage

Analysis

max time kernel
65s
max time network
66s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 19:27

Sharing

Report Analysis Logs

General

Target

file.dll
Size

164KB
MD5

81d10b00af8c31044ea7aa32e4958625
SHA1

2ae88e4d130eb6e57f6b03a8264f11d1a6fdfdcf
SHA256

c35f35a9e54f35375bc2f72842d038c4121a5cc6314ac7cbabca6a8dc463cfcd
SHA512

aabd830b5a342cbb67fbc76afe9d87acf1088b0309d4350b7bc28ba7d214f2cc667a790cba9e6fd283773180daab37e0d42ef4bacccb4ad1a493fa7675f8bb3e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1688 wrote to memory of 2008	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2008	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2008	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2008	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2008	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2008	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2008	1688	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
2⤵
PID:2008

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-0-0x0000000000000000-mapping.dmp

Download