ce4edec3111f584bc29e51a2b92011c0316f5bc570b00fc4eba16e15e426d5ef | Triage

Analysis

max time kernel
99s
max time network
67s
platform
windows10_x64
resource
win10v20201028
submitted
14-12-2020 12:49

Sharing

Report Analysis Logs

General

Target

afd0df3341add43b263b1ecb4a52905c.dll
Size

667KB
MD5

afd0df3341add43b263b1ecb4a52905c
SHA1

d8dc8121ed006cf2a77e671e01e8bbc921695541
SHA256

ce4edec3111f584bc29e51a2b92011c0316f5bc570b00fc4eba16e15e426d5ef
SHA512

13584a0fb48fb1396239182c14a9f341c03099b6247a7f361dcba5e1e55e8ce58b3a734d6eadeb4cbbfe37678621d06202c3f3b4fb82211d2ba55093705e9674

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 672 wrote to memory of 1488	672	rundll32.exe	rundll32.exe
PID 672 wrote to memory of 1488	672	rundll32.exe	rundll32.exe
PID 672 wrote to memory of 1488	672	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\afd0df3341add43b263b1ecb4a52905c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\afd0df3341add43b263b1ecb4a52905c.dll,#1
2⤵
PID:1488

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-2-0x0000000000000000-mapping.dmp

Download