5a000707cbde902af60095f470fffe45f05a6b72877eaa88b52ab790b677a197 | Triage

Analysis

max time kernel
117s
max time network
131s
platform
windows10_x64
resource
win10v20201028
submitted
15-11-2020 22:49

Sharing

Report Analysis Logs

General

Target

5a000707cbde902af60095f470fffe45f05a6b72877eaa88b52ab790b677a197.dll
Size

207KB
MD5

60777c3c48cd4af011157bffca17f3dd
SHA1

de42ffa2330d3fe8d881b2504f93e6ea98ca0160
SHA256

5a000707cbde902af60095f470fffe45f05a6b72877eaa88b52ab790b677a197
SHA512

9d273470d4c078fa695bbb863375285b4dab8202f6cf0bae05be2144d929704bb3669eae751c984b555177d1e5d5bf3f728df036ec97eb0fa19108d7ef9f7a9c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 828 wrote to memory of 1424	828	rundll32.exe	rundll32.exe
PID 828 wrote to memory of 1424	828	rundll32.exe	rundll32.exe
PID 828 wrote to memory of 1424	828	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a000707cbde902af60095f470fffe45f05a6b72877eaa88b52ab790b677a197.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a000707cbde902af60095f470fffe45f05a6b72877eaa88b52ab790b677a197.dll,#1
2⤵
PID:1424

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1424-0-0x0000000000000000-mapping.dmp

Download