8e34c697b603788b9baeecfb375c466cb8468a322d6ae9b81fc41fb61472c3da | Triage

Resubmissions

13-01-2021 07:45

210113-wgq8m6wdxj 1

11-01-2021 18:16

210111-f6rbs3f8zj 1

Analysis

max time kernel
18s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
13-01-2021 07:45

Sharing

Report Analysis Logs

General

Target

5268c190b3a6940bc7c8f0361f3a187f.dll
Size

305KB
MD5

5268c190b3a6940bc7c8f0361f3a187f
SHA1

56b1b5066f88e07f494e5e97f9a8b791cc9d7bd2
SHA256

8e34c697b603788b9baeecfb375c466cb8468a322d6ae9b81fc41fb61472c3da
SHA512

c44274ee84f9fdfdce444b36e33b2ca2db265cbc99a9ffb7fe5ebbbc79cb9b82f19cb93477d4211d9122cd7043a5964c115d2bc4adc4af0ef7c0b60b069481d0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1824 wrote to memory of 1052	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1052	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1052	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1052	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1052	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1052	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1052	1824	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5268c190b3a6940bc7c8f0361f3a187f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5268c190b3a6940bc7c8f0361f3a187f.dll,#1
2⤵
PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-2-0x0000000000000000-mapping.dmp

Download