1871254a2f867c4325567160a2c79c1d8bdc53231863cb082e266c3c29e981be | Triage

Resubmissions

12-01-2021 12:27

210112-d1k5vnv34j 9

11-01-2021 13:45

210111-x57bch18qn 9

Analysis

max time kernel
150s
max time network
91s
platform
windows7_x64
resource
win7v20201028
submitted
12-01-2021 12:27

Sharing

Report Analysis Logs

General

Target

1871254a2f867c4325567160a2c79c1d8bdc53231863cb082e266c3c29e981be.dll
Size

2.2MB
MD5

3002d8cd12f80f4a60adeb86f7a87c8a
SHA1

4bdf7f7c8cbe9eef4e6ccd8545098da59ffc1899
SHA256

1871254a2f867c4325567160a2c79c1d8bdc53231863cb082e266c3c29e981be
SHA512

1958cacf99641e5345e2a65dff7279f15bcce234239dfd1f9146647b367274607aa018aba31c90ad61ca31e66a819f1200ee482c7e49d203ba13e7327360bbdd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 744 wrote to memory of 1896	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 1896	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 1896	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 1896	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 1896	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 1896	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 1896	744	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1871254a2f867c4325567160a2c79c1d8bdc53231863cb082e266c3c29e981be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1871254a2f867c4325567160a2c79c1d8bdc53231863cb082e266c3c29e981be.dll,#1
2⤵
PID:1896

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1896-2-0x0000000000000000-mapping.dmp

Download