Analysis
-
max time kernel
89s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-12-2020 15:21
Static task
static1
Behavioral task
behavioral1
Sample
83bd32450a481cae11143042495d98c2.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
83bd32450a481cae11143042495d98c2.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
83bd32450a481cae11143042495d98c2.dll
-
Size
667KB
-
MD5
83bd32450a481cae11143042495d98c2
-
SHA1
42b44b917034e1d014a68c9082cfa244d5e52c87
-
SHA256
0074e4aacd3a8c3ccf4859f7044629ce7458f7a553b7a0dde51fda2ed68645b1
-
SHA512
8b84c63bb2d13adc97dc7c19d4a61f2aae2216af3346a788eff0ab0745a217999f87968f95fa42350e337469e4916c958cd379550b4d2aecfacdafb184ceb0a4
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4068 wrote to memory of 60 4068 rundll32.exe rundll32.exe PID 4068 wrote to memory of 60 4068 rundll32.exe rundll32.exe PID 4068 wrote to memory of 60 4068 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\83bd32450a481cae11143042495d98c2.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\83bd32450a481cae11143042495d98c2.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/60-2-0x0000000000000000-mapping.dmp