d8f3fedde975e393530b694eee1ef9c981b48bc46b4e24749c20189a6fa58e79 | Triage

Analysis

max time kernel
5s
max time network
15s
platform
windows7_x64
resource
win7v20201028
submitted
18-02-2021 19:50

Sharing

Report Analysis Logs

General

Target

202102121641_4b32c3c2d28237ba331ae94e7fe4dfb566a0902d59eb84aa793b3adf0a5f378c.bin.dll
Size

603KB
MD5

0da0dabe99b1df919b6fd27d803db851
SHA1

9b4c420185069f81ba887cd38feee498d2c3f1d6
SHA256

4b32c3c2d28237ba331ae94e7fe4dfb566a0902d59eb84aa793b3adf0a5f378c
SHA512

6bcbcaed03b99438a25efec6492153db82b5bbcef91a892abacbe5dc2ac9d78e89e2a3104ca411dffe242f6a3ead752d824cf054a7086a30039755b747400b03

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1064 wrote to memory of 1884	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1884	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1884	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1884	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1884	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1884	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1884	1064	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\202102121641_4b32c3c2d28237ba331ae94e7fe4dfb566a0902d59eb84aa793b3adf0a5f378c.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\202102121641_4b32c3c2d28237ba331ae94e7fe4dfb566a0902d59eb84aa793b3adf0a5f378c.bin.dll,#1
2⤵
PID:1884

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-2-0x0000000000000000-mapping.dmp

Download
memory/1884-3-0x0000000076101000-0x0000000076103000-memory.dmp

Filesize
8KB

Download