d720fe074aef13fab414b8ae56f144098632285fc43dec21da763260e0564005 | Triage

Analysis

max time kernel
17s
max time network
122s
platform
windows10_x64
resource
win10v20201028
submitted
28-11-2020 07:15

Sharing

Report Analysis Logs

General

Target

9237534.dll
Size

2.9MB
MD5

4442d842b68c13c8db29005e3e24a7ce
SHA1

cf17cdd65041c39f93371415eb12bc9d667e5d0c
SHA256

d720fe074aef13fab414b8ae56f144098632285fc43dec21da763260e0564005
SHA512

d15006c938f4081aea2ae3d8b06884d42cd961696951a35de2d962cbc24205f51b8de926a7ca33f36cbff8dea1001daa383ab95d7773b7e41cb738157fccaf60

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 728 wrote to memory of 3896	728	rundll32.exe	rundll32.exe
PID 728 wrote to memory of 3896	728	rundll32.exe	rundll32.exe
PID 728 wrote to memory of 3896	728	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9237534.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9237534.dll,#1
2⤵
PID:3896

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3896-2-0x0000000000000000-mapping.dmp

Download