09f524453a6846e6e2d6aaa874dd60f6aa0f73de45b83192bca7c09631bbe5cc | Triage

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7v20201028
submitted
14-01-2021 06:35

Sharing

Report Analysis Logs

General

Target

d37fcaa31e9c9103b7086ed2611ce358.dll
Size

236KB
MD5

d37fcaa31e9c9103b7086ed2611ce358
SHA1

41a86d3d945b24df33b96aba20354b1ab4c97eef
SHA256

09f524453a6846e6e2d6aaa874dd60f6aa0f73de45b83192bca7c09631bbe5cc
SHA512

660849efb03a4202233516ed21f471ad83ceb0d5a5dad4a8aaeaba41b5e0dbe23142bbe00687e007b4c67ac24ed6d3351933fdd1d37f71e649e97432ad48d3e2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1852 wrote to memory of 1328	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1328	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1328	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1328	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1328	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1328	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1328	1852	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d37fcaa31e9c9103b7086ed2611ce358.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d37fcaa31e9c9103b7086ed2611ce358.dll,#1
2⤵
PID:1328

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-2-0x0000000000000000-mapping.dmp

Download