773d0799c4d6cca486b22a0f03c166f6dc45eb84d635b8f6a5bfabc77821648d | Triage

Analysis

max time kernel
134s
max time network
150s
platform
windows7_x64
resource
win7v20201028
submitted
11-11-2020 11:09

Sharing

Report Analysis Logs

General

Target

773d0799c4d6cca486b22a0f03c166f6dc45eb84d635b8f6a5bfabc77821648d.dll
Size

207KB
MD5

a3923f5a4bb302e1397d617124f22a03
SHA1

ed5632cdb19f8c0b4fa2b4d7b1a2c590428639eb
SHA256

773d0799c4d6cca486b22a0f03c166f6dc45eb84d635b8f6a5bfabc77821648d
SHA512

f24a072e6cab8d2e09ba79ed4c05d3847d4e7793301f8081c81b6115d60bd023512cdc89b3edc3f9c7c12e7f5275385730e8d494583974cc58c54d5fe1bf035d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 300 wrote to memory of 1636	300	rundll32.exe	rundll32.exe
PID 300 wrote to memory of 1636	300	rundll32.exe	rundll32.exe
PID 300 wrote to memory of 1636	300	rundll32.exe	rundll32.exe
PID 300 wrote to memory of 1636	300	rundll32.exe	rundll32.exe
PID 300 wrote to memory of 1636	300	rundll32.exe	rundll32.exe
PID 300 wrote to memory of 1636	300	rundll32.exe	rundll32.exe
PID 300 wrote to memory of 1636	300	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\773d0799c4d6cca486b22a0f03c166f6dc45eb84d635b8f6a5bfabc77821648d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:300

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\773d0799c4d6cca486b22a0f03c166f6dc45eb84d635b8f6a5bfabc77821648d.dll,#1
2⤵
PID:1636

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-0-0x0000000000000000-mapping.dmp

Download