b3bb51237eb75fceb5a9ecf67ca05542dbf1a12d9ea199f9217a3e50e1d7800f | Triage™

Analysis

max time kernel
16s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
28/11/2020, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3f0bfcb42a325dfb4b455d783751866d.dll
Size 528KB
Sample201128-96neyx684a
SHA256 b3bb51237eb75fceb5a9ecf67ca05542dbf1a12d9ea199f9217a3e50e1d7800f
MD5 3f0bfcb42a325dfb4b455d783751866d
SHA1 93e370d845e68d0d7cd410d2f6f37f08d259c1a7
SHA512 7ba2f06a985f109c4986d44ada8e768c9a4bc7deb631b569bc839d347a0342710d15fbed495c9e78b6219c958eb6260c01b143546fcf5a059073df7b457c85e5
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1292	580	rundll32.exe	71
PID 580 wrote to memory of 1292	580	rundll32.exe	71
PID 580 wrote to memory of 1292	580	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f0bfcb42a325dfb4b455d783751866d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f0bfcb42a325dfb4b455d783751866d.dll,#1
  2⤵
  PID:1292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads