0201b92d3d877df4de0d109ce6f3d647cfde3ab9d881f8cddc10d4bb8e5f21ad | Triage

Analysis

max time kernel
3s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
20-12-2020 14:38

Sharing

Report Analysis Logs

General

Target

ply606.dll
Size

549KB
MD5

b32892d699c39949e9b648d6b72fe5cf
SHA1

b67048acde6f73e76a5004331130824fa810670e
SHA256

0201b92d3d877df4de0d109ce6f3d647cfde3ab9d881f8cddc10d4bb8e5f21ad
SHA512

6c73cd30febac92a59785bac5b13d25b5485e9e0e16ec82e6053f5ec6e342f42dd0273dd8548630946594816bc9bb7af18e6a87f15afa07cb5106d6df9f966b6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 1640	596	rundll32.exe	22
PID 596 wrote to memory of 1640	596	rundll32.exe	22
PID 596 wrote to memory of 1640	596	rundll32.exe	22
PID 596 wrote to memory of 1640	596	rundll32.exe	22
PID 596 wrote to memory of 1640	596	rundll32.exe	22
PID 596 wrote to memory of 1640	596	rundll32.exe	22
PID 596 wrote to memory of 1640	596	rundll32.exe	22

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ply606.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ply606.dll,#1
  2⤵
  PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads