7efc45ab60352c5ace8b1de8ad8911eaa468140dab5e8df537a19381ce11ee7e | Triage

Analysis

max time kernel
19s
max time network
128s
platform
windows10_x64
resource
win10v20201028
submitted
13-01-2021 12:02

Sharing

Report Analysis Logs

General

Target

7efc45ab60352c5ace8b1de8ad8911eaa468140dab5e8df537a19381ce11ee7e.dll
Size

271KB
MD5

cfc1fa6c58d1bf7a0d7dcceb7cbc91e9
SHA1

13e6f0472f2b615db5fea7ff8ecb5e388710a8de
SHA256

7efc45ab60352c5ace8b1de8ad8911eaa468140dab5e8df537a19381ce11ee7e
SHA512

351c506cf260f2da60367fe49204b55fbfdd9819f4a13214ba7ae3cb7696ffad65552af069cd029c8e5e9c605ff86d1b2d2b201fbfc6526d6a3f2d69383cd975

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

13 908 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

908 rundll32.exe
908 rundll32.exe
908 rundll32.exe
908 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1924 wrote to memory of 908	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 908	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 908	1924	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7efc45ab60352c5ace8b1de8ad8911eaa468140dab5e8df537a19381ce11ee7e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7efc45ab60352c5ace8b1de8ad8911eaa468140dab5e8df537a19381ce11ee7e.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-2-0x0000000000000000-mapping.dmp

Download