d4a74e889078ac15ba39aa3c4ac3cd7c2facf219b2d99ce646c8b0b92edccb6a | Triage

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7v20201028
submitted
15-11-2020 22:45

Sharing

Report Analysis Logs

General

Target

d4a74e889078ac15ba39aa3c4ac3cd7c2facf219b2d99ce646c8b0b92edccb6a.dll
Size

207KB
MD5

a9b7736aee26e76ef5ebbd043c6d0771
SHA1

d29493e4220d5778497b7e5a42dfd69e4a7afb5b
SHA256

d4a74e889078ac15ba39aa3c4ac3cd7c2facf219b2d99ce646c8b0b92edccb6a
SHA512

b9137c9ac76548a2d4387c2637286b09b9224983022df58600754ec8858e1a2ee0320414da19ad85c0892cfda88c45ed550c8abf88e543ee9fe02b7c7278b8fe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1880 wrote to memory of 1296	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1296	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1296	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1296	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1296	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1296	1880	rundll32.exe	rundll32.exe
PID 1880 wrote to memory of 1296	1880	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4a74e889078ac15ba39aa3c4ac3cd7c2facf219b2d99ce646c8b0b92edccb6a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4a74e889078ac15ba39aa3c4ac3cd7c2facf219b2d99ce646c8b0b92edccb6a.dll,#1
2⤵
PID:1296

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1296-0-0x0000000000000000-mapping.dmp

Download