be7281a7580f4bde8882b2977d582c295a7e95f409caa0f9befb62be25ad3e48 | Triage

Analysis

max time kernel
14s
max time network
66s
platform
windows10_x64
resource
win10v20201028
submitted
17-11-2020 11:43

Sharing

Report Analysis Logs

General

Target

288fb9e8fb95fc6fb14dff10d2fd978f.dll
Size

207KB
MD5

db2e99804366e2863c05a22405982482
SHA1

d4938506e6d0bdd4a2ee35d6293e685e807b6cfb
SHA256

be7281a7580f4bde8882b2977d582c295a7e95f409caa0f9befb62be25ad3e48
SHA512

556849ecb486c66e4124dbdca2c4ea3bd8a38b5efee82c6a41c957e7ea590f841d42436c9ee4a42530cb62d78f6aa6f25c8fdcf2c8cf2c303d2c070dd28635e7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 948 wrote to memory of 1860	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1860	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1860	948	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\288fb9e8fb95fc6fb14dff10d2fd978f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\288fb9e8fb95fc6fb14dff10d2fd978f.dll,#1
2⤵
PID:1860

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-0-0x0000000000000000-mapping.dmp

Download