849fc5dacb287f250b79357cf2e297988798e99fe23c0b098a3f8cd84c729be1 | Triage

Analysis

max time kernel
135s
max time network
137s
platform
windows7_x64
resource
win7v20201028
submitted
12-11-2020 14:04

Sharing

Report Analysis Logs

General

Target

849fc5dacb287f250b79357cf2e297988798e99fe23c0b098a3f8cd84c729be1.dll
Size

207KB
MD5

005c0369057f0c67b56865dab7d4a6c4
SHA1

60e2e28f3272554f9c2e1a694e412a77f2e0aee4
SHA256

849fc5dacb287f250b79357cf2e297988798e99fe23c0b098a3f8cd84c729be1
SHA512

2ed1d49f723e823eba86e5c45cfac501bd74ae30b5b6c188a537ec71317b7fb2c683b84e9f325a38bc868fc24ae10cb374872c0de1fbcd757ac6a4356c59b452

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1880 wrote to memory of 1280	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1280	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1280	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1280	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1280	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1280	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1280	1880	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\849fc5dacb287f250b79357cf2e297988798e99fe23c0b098a3f8cd84c729be1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\849fc5dacb287f250b79357cf2e297988798e99fe23c0b098a3f8cd84c729be1.dll,#1
2⤵
PID:1280

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-0-0x0000000000000000-mapping.dmp

Download