7ca733ebb2fc1c0fc99bb61736c8c5a2b619110ef0ce8119207157247ecee478 | Triage™

Analysis

max time kernel
57s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
03/12/2020, 09:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xspcd1.dll
Size 465KB
Sample201203-457fcndwr2
SHA256 7ca733ebb2fc1c0fc99bb61736c8c5a2b619110ef0ce8119207157247ecee478
MD5 7c104281fed4b9d6e39f56cef9ed178b
SHA1 ad18e810016841dad044d32992396f0950848bbb
SHA512 ad803697a7fa58f30f26d82d7947a8110fdc1500ece7c02d95ef97962a497fed3fd3230e98e5ea69344ba65f4f2b48333b6498ba86b4b65d3ba8a0647c32d2fe
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 752	848	rundll32.exe	22
PID 848 wrote to memory of 752	848	rundll32.exe	22
PID 848 wrote to memory of 752	848	rundll32.exe	22
PID 848 wrote to memory of 752	848	rundll32.exe	22
PID 848 wrote to memory of 752	848	rundll32.exe	22
PID 848 wrote to memory of 752	848	rundll32.exe	22
PID 848 wrote to memory of 752	848	rundll32.exe	22

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xspcd1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\xspcd1.dll,#1
  2⤵
  PID:752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads