527ea920beb2678d7a065a45b284d89833ddf5825291b8aefd09b1c1c48f2dcb | Triage

Analysis

max time kernel
14s
max time network
114s
platform
windows10_x64
resource
win10v20201028
submitted
15-11-2020 22:40

Sharing

Report Analysis Logs

General

Target

527ea920beb2678d7a065a45b284d89833ddf5825291b8aefd09b1c1c48f2dcb.dll
Size

207KB
MD5

7bdca83f1ae5f116c9b2991da3495e30
SHA1

ab3b949e90c320db0e6b7fe1dc2704d164c05578
SHA256

527ea920beb2678d7a065a45b284d89833ddf5825291b8aefd09b1c1c48f2dcb
SHA512

785f37da8f7666a8d0c13271429129811be9679ddd5fc5987768895f0dd672de1324df197d27a47a1b3c9402debcad9bac256bc8a0ba96fe1665e7488d670b86

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3980 wrote to memory of 3224	3980	rundll32.exe	rundll32.exe
PID 3980 wrote to memory of 3224	3980	rundll32.exe	rundll32.exe
PID 3980 wrote to memory of 3224	3980	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\527ea920beb2678d7a065a45b284d89833ddf5825291b8aefd09b1c1c48f2dcb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\527ea920beb2678d7a065a45b284d89833ddf5825291b8aefd09b1c1c48f2dcb.dll,#1
2⤵
PID:3224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3224-0-0x0000000000000000-mapping.dmp

Download