72b0f29b8686b8ccc5478c1e232a4c979247f04af0b266a02e95179c05e1ce0b | Triage

Analysis

max time kernel
5s
max time network
10s
platform
windows7_x64
resource
win7v20201028
submitted
15-11-2020 22:52

Sharing

Report Analysis Logs

General

Target

72b0f29b8686b8ccc5478c1e232a4c979247f04af0b266a02e95179c05e1ce0b.dll
Size

207KB
MD5

91e0f5fec809b5761b0baa2bfef3be8a
SHA1

d501db54615a21526f8e399356ae177e81f43765
SHA256

72b0f29b8686b8ccc5478c1e232a4c979247f04af0b266a02e95179c05e1ce0b
SHA512

110153f3655030bb73478821586e1fe9f4c65bb77e3aa0b17add5e7ddb323c98bbfffd60676f7d9806073840c8c11ab83a4daae82023fa093e582df3964ada9b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 288 wrote to memory of 1868	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 1868	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 1868	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 1868	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 1868	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 1868	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 1868	288	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72b0f29b8686b8ccc5478c1e232a4c979247f04af0b266a02e95179c05e1ce0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72b0f29b8686b8ccc5478c1e232a4c979247f04af0b266a02e95179c05e1ce0b.dll,#1
2⤵
PID:1868

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1868-0-0x0000000000000000-mapping.dmp

Download