d8f3fedde975e393530b694eee1ef9c981b48bc46b4e24749c20189a6fa58e79 | Triage

Analysis

max time kernel
6s
max time network
15s
platform
windows7_x64
resource
win7v20201028
submitted
18-02-2021 19:50

Sharing

Report Analysis Logs

General

Target

202102121641_f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73.bin.dll
Size

329KB
MD5

48cab21fcbe254e7c83f4c1d455a39dc
SHA1

b96c1f765abb14eb401cacab6f6e203c3a255df9
SHA256

f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73
SHA512

0375a26a2d6d8990d202b75b4cb6797d03300ddc077c4dcb05778365212644ee49ce6e437fde0b77e1b8179d01ffad028635869d2f3897333b85471724d15ebc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1616 wrote to memory of 1956	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1956	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1956	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1956	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1956	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1956	1616	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 1956	1616	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\202102121641_f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\202102121641_f1b9d5520ba13179e19b336e542d18b0bd9f39a2b41d88a739625c8480422b73.bin.dll,#1
2⤵
PID:1956

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-2-0x0000000000000000-mapping.dmp

Download
memory/1956-3-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download