6b1c0ee446164e6d7c87ad73589570d3ddafda57d73cab513ac6d8ccd248e948 | Triage

Analysis

max time kernel
3s
max time network
10s
platform
windows7_x64
resource
win7v20201028
submitted
11-11-2020 11:01

Sharing

Report Analysis Logs

General

Target

6b1c0ee446164e6d7c87ad73589570d3ddafda57d73cab513ac6d8ccd248e948.dll
Size

207KB
MD5

c70f58a9e0e53319d41d90e0d809d0c9
SHA1

37ae61830d28fb573aa4a06a5239c2f9a98ce9e9
SHA256

6b1c0ee446164e6d7c87ad73589570d3ddafda57d73cab513ac6d8ccd248e948
SHA512

c4622b1a77f9c5f6c88db722e9de5b1be62d79e3e96d4feca3100d22be6a25766530175152fc08a883bfbd6a9ebf89a9b789e1c6a909ee3d51d406c6eef12a0f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 752 wrote to memory of 1600	752	rundll32.exe	rundll32.exe
PID 752 wrote to memory of 1600	752	rundll32.exe	rundll32.exe
PID 752 wrote to memory of 1600	752	rundll32.exe	rundll32.exe
PID 752 wrote to memory of 1600	752	rundll32.exe	rundll32.exe
PID 752 wrote to memory of 1600	752	rundll32.exe	rundll32.exe
PID 752 wrote to memory of 1600	752	rundll32.exe	rundll32.exe
PID 752 wrote to memory of 1600	752	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b1c0ee446164e6d7c87ad73589570d3ddafda57d73cab513ac6d8ccd248e948.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b1c0ee446164e6d7c87ad73589570d3ddafda57d73cab513ac6d8ccd248e948.dll,#1
2⤵
PID:1600

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-0-0x0000000000000000-mapping.dmp

Download