4649221068ea794a26b14eb024f108690976c78b6c79ca3cab32aec5c006202c | Triage

Analysis

max time kernel
12s
max time network
111s
platform
windows10_x64
resource
win10v20201028
submitted
12-11-2020 14:42

Sharing

Report Analysis Logs

General

Target

4649221068ea794a26b14eb024f108690976c78b6c79ca3cab32aec5c006202c.dll
Size

207KB
MD5

ee03b27a68df31d5ce5d48b12fa5e8ab
SHA1

91d9fb71fd3e0864be41b44dc91f35e9edc2d9fe
SHA256

4649221068ea794a26b14eb024f108690976c78b6c79ca3cab32aec5c006202c
SHA512

a393f329a92b464cf81280525e781f543ec9730bbe9980782e97b26fc474157022205dd59e9b20aa38934e762312b11c72b9c200cffbba9d2c0438fa36d0a0fd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 576 wrote to memory of 1224	576	rundll32.exe	rundll32.exe
PID 576 wrote to memory of 1224	576	rundll32.exe	rundll32.exe
PID 576 wrote to memory of 1224	576	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4649221068ea794a26b14eb024f108690976c78b6c79ca3cab32aec5c006202c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4649221068ea794a26b14eb024f108690976c78b6c79ca3cab32aec5c006202c.dll,#1
2⤵
PID:1224

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-0-0x0000000000000000-mapping.dmp

Download