Analysis
-
max time kernel
10s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
22-01-2021 08:05
Static task
static1
Behavioral task
behavioral1
Sample
moonphobia1.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
moonphobia1.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Errors
Reason
Machine shutdown
General
-
Target
moonphobia1.dll
-
Size
3.0MB
-
MD5
36ed93008742499a6b75ac5b49b79d7c
-
SHA1
e2e6b95dabdcc0c66488b05268e72f546f780103
-
SHA256
d447b199616dc31d60c5d42698957997b199a491e71b25da0d97b34a63a81c7f
-
SHA512
18913da968a6f5a7ad6741155b5e2a1e5e500e782b287e16e3dc790b86294bd7ab7ea16f7206df81b2c991ee616b550525ae124acf32a9936eed81e95133cacb
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1964 wrote to memory of 1072 1964 rundll32.exe rundll32.exe PID 1964 wrote to memory of 1072 1964 rundll32.exe rundll32.exe PID 1964 wrote to memory of 1072 1964 rundll32.exe rundll32.exe PID 1964 wrote to memory of 1072 1964 rundll32.exe rundll32.exe PID 1964 wrote to memory of 1072 1964 rundll32.exe rundll32.exe PID 1964 wrote to memory of 1072 1964 rundll32.exe rundll32.exe PID 1964 wrote to memory of 1072 1964 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\moonphobia1.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\moonphobia1.dll,#12⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1064-7-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/1072-2-0x0000000000000000-mapping.dmp
-
memory/1072-3-0x00000000750C1000-0x00000000750C3000-memory.dmpFilesize
8KB
-
memory/1708-4-0x000007FEFB541000-0x000007FEFB543000-memory.dmpFilesize
8KB
-
memory/1708-5-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB