2abccc4287c95d66c28ee3048a6afd18a2f919d064998f65cd57050a59b473f0 | Triage

Analysis

max time kernel
6s
max time network
21s
platform
windows7_x64
resource
win7v20201028
submitted
15-11-2020 22:39

Sharing

Report Analysis Logs

General

Target

2abccc4287c95d66c28ee3048a6afd18a2f919d064998f65cd57050a59b473f0.dll
Size

207KB
MD5

9b4e6583382d217cdc1e017797a469be
SHA1

de3d60e2e4f57f4ffc9e801eb353b4ba6d534885
SHA256

2abccc4287c95d66c28ee3048a6afd18a2f919d064998f65cd57050a59b473f0
SHA512

2cc7339a5bcf8b83a3fb156f9c27c03e59a49a644bb3ed4753a4ae322eb7383c1ba45187e3a373be991c0a722f5eaab703f2a255faec216afcf1b4caf255c7ba

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1764 wrote to memory of 1824	1764	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1824	1764	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1824	1764	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1824	1764	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1824	1764	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1824	1764	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1824	1764	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2abccc4287c95d66c28ee3048a6afd18a2f919d064998f65cd57050a59b473f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2abccc4287c95d66c28ee3048a6afd18a2f919d064998f65cd57050a59b473f0.dll,#1
2⤵
PID:1824

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-0-0x0000000000000000-mapping.dmp

Download