9891284ac8d3329d6f69e1fa310886a53802a70672634dd64caaee3a58ba0a10 | Triage

Analysis

max time kernel
12s
max time network
111s
platform
windows10_x64
resource
win10v20201028
submitted
15-11-2020 23:04

Sharing

Report Analysis Logs

General

Target

9891284ac8d3329d6f69e1fa310886a53802a70672634dd64caaee3a58ba0a10.dll
Size

207KB
MD5

9408791cf02d1ab6e1f1945919fe0f4d
SHA1

c39ee8fe1a99c144130166c8faec1f4ed3011e0a
SHA256

9891284ac8d3329d6f69e1fa310886a53802a70672634dd64caaee3a58ba0a10
SHA512

8c20d0ceff7e5fd6e6c1a2dbb26fa030158da33bc9d0c6ebac2f210e7d84844151103db94612697e412e84424517ce2c33802a287039d2a585d2444dd6e34c1a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4764 wrote to memory of 4776	4764	rundll32.exe	rundll32.exe
PID 4764 wrote to memory of 4776	4764	rundll32.exe	rundll32.exe
PID 4764 wrote to memory of 4776	4764	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9891284ac8d3329d6f69e1fa310886a53802a70672634dd64caaee3a58ba0a10.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9891284ac8d3329d6f69e1fa310886a53802a70672634dd64caaee3a58ba0a10.dll,#1
2⤵
PID:4776

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4776-0-0x0000000000000000-mapping.dmp

Download