4c414d6237c225d3bba766647807b0f2c32d4f400e585ee3f7fbe3d8b3b54c70 | Triage

Analysis

max time kernel
96s
max time network
69s
platform
windows10_x64
resource
win10v20201028
submitted
14-12-2020 17:13

Sharing

Report Analysis Logs

General

Target

f7c5fdac4daf9505c16d353fa9b0b577.dll
Size

667KB
MD5

f7c5fdac4daf9505c16d353fa9b0b577
SHA1

0195de0967e2a5a851280fd99464ec739e0979dd
SHA256

4c414d6237c225d3bba766647807b0f2c32d4f400e585ee3f7fbe3d8b3b54c70
SHA512

e1f4fc7518895b6e936f4b528ff922f47c7dbe9596c3cf4f38fabf1e2a36117bf04269bb1f64b3beada6ccca6713c7f4bc79345f45e71dc691562bf6ba137892

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1048 wrote to memory of 1416	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 1416	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 1416	1048	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7c5fdac4daf9505c16d353fa9b0b577.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7c5fdac4daf9505c16d353fa9b0b577.dll,#1
2⤵
PID:1416

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-2-0x0000000000000000-mapping.dmp

Download