7a745309ede442df8b60129c159928f87d52ed151f53266a217e721cf2d6012a | Triage

Resubmissions

17-12-2020 08:38

201217-qvcs4jyy9j 9

16-12-2020 21:43

201216-t8px7jr1q2 9

Analysis

max time kernel
4s
max time network
10s
platform
windows7_x64
resource
win7v20201028
submitted
16-12-2020 21:43

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Mal.EncPk-APV.26203.27624.dll
Size

2.2MB
MD5

956b50fb7963b465a2fda42c34efdf0e
SHA1

1741aeb38a3fdd9c5645f60e27fcd8bff2396bbb
SHA256

7a745309ede442df8b60129c159928f87d52ed151f53266a217e721cf2d6012a
SHA512

eab8eb5a1066b48c085107ba0863a73008c7f7ddbf171fd684ef2f32ca1a495ac48c3bc62462811b6830fbe18472ebf971b6f3f8428eb659ec19dba353a7cc4d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1684 wrote to memory of 1492	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1492	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1492	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1492	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1492	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1492	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1492	1684	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Mal.EncPk-APV.26203.27624.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Mal.EncPk-APV.26203.27624.dll,#1
2⤵
PID:1492

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-2-0x0000000000000000-mapping.dmp

Download