fce4810786155e188851f14000159c67656b152b5e1bf6f1aafa27dce4837a49 | Triage

Analysis

max time kernel
2s
max time network
10s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 19:27

Sharing

Report Analysis Logs

General

Target

file.dll
Size

164KB
MD5

7195a6dc7149aa9dcf7b1474251e9c3b
SHA1

39a5e923d7eab221a8718d93c719368f73d24ba8
SHA256

fce4810786155e188851f14000159c67656b152b5e1bf6f1aafa27dce4837a49
SHA512

1445780c190a5897cec1a7ec86e4f6ef2c2ca35de05b94004aad0dda5fd5483c1789eb8f8238d35eb67148289f5824b89d5fb68c7f282befa739d9cfdbf7dd42

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1756 wrote to memory of 1916	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1916	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1916	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1916	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1916	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1916	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 1916	1756	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
2⤵
PID:1916

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1916-0-0x0000000000000000-mapping.dmp

Download