e799e731544a2516301735429bebfefd215ed782b1aa827a62d857d692e41560 | Triage™

Analysis

max time kernel
4s
max time network
12s
platform
windows7_x64
resource
win7v20201028
submitted
08/01/2021, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
testtabDll32.dll
Size 625KB
Sample210108-e3pqlfsvq2
SHA256 e799e731544a2516301735429bebfefd215ed782b1aa827a62d857d692e41560
MD5 d6e0c345f3abc33f2bb4e4ba41f01b1f
SHA1 e8cb7de0c5260772ea1042c957d3fdbe445fa025
SHA512 342edcb7ebbe01747b264a070141120880ff35104c0a2684c7268d1bf7795381ddbbe0a090eba7f7d5ab99453b748ec8afcad9e4003f90780afbbf4b9d5e25c1
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1852	1584	rundll32.exe	26
PID 1584 wrote to memory of 1852	1584	rundll32.exe	26
PID 1584 wrote to memory of 1852	1584	rundll32.exe	26
PID 1584 wrote to memory of 1852	1584	rundll32.exe	26
PID 1584 wrote to memory of 1852	1584	rundll32.exe	26
PID 1584 wrote to memory of 1852	1584	rundll32.exe	26
PID 1584 wrote to memory of 1852	1584	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\testtabDll32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\testtabDll32.dll,#1
  2⤵
  PID:1852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads