87551a242ba5861045a09e740e68d37b2a22c0a15c77723782f9568450cb5bd9 | Triage

Analysis

max time kernel
3s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 19:27

Sharing

Report Analysis Logs

General

Target

file.dll
Size

166KB
MD5

9c9f5d600779b8edb252f505f2ae7e98
SHA1

dbc70df803700c5a7706dcca5eda2833775b09c8
SHA256

87551a242ba5861045a09e740e68d37b2a22c0a15c77723782f9568450cb5bd9
SHA512

15d8b20a1d8243b3342a2e3c2c638ef37de759abe4a50379062ff93254a4c27a6dd841afc8e7741494ef00e3e4c3027f2c3281e06b9fe72c70056c008fb72731

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1916 wrote to memory of 1188	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1188	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1188	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1188	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1188	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1188	1916	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1188	1916	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
2⤵
PID:1188

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1188-0-0x0000000000000000-mapping.dmp

Download