5094e17105845238a6a2aaf54cd6769733032009a9ddd24e8af046837c1c12e6 | Triage

Analysis

max time kernel
120s
max time network
119s
platform
windows10_x64
resource
win10v20201028
submitted
06-12-2020 23:03

Sharing

Report Analysis Logs

General

Target

md.dll
Size

2.8MB
MD5

04416cf8bf1c7d31a606edff765529df
SHA1

bb6abc451db164e17a5dd030b355b309c219623d
SHA256

5094e17105845238a6a2aaf54cd6769733032009a9ddd24e8af046837c1c12e6
SHA512

348e86e7efa139f90fe71b751d476aa0ea6e83cc0cc37f9d18b4d9ebc0d37a47bafc4d911a603457bd6d36b7ed323520b11df06edb69605c961c721037628317

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3152 wrote to memory of 3984	3152	rundll32.exe	rundll32.exe
PID 3152 wrote to memory of 3984	3152	rundll32.exe	rundll32.exe
PID 3152 wrote to memory of 3984	3152	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\md.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3152

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\md.dll,#1
2⤵
PID:3984

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3984-2-0x0000000000000000-mapping.dmp

Download