1149594eebfbb939fa4c36c7f88c3123209d30be43c064bcb71057ccf9c874ab | Triage

Analysis

max time kernel
3s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
23-02-2021 12:38

Sharing

Report Analysis Logs

General

Target

1149594eebfbb939fa4c36c7f88c3123209d30be43c064bcb71057ccf9c874ab.dll
Size

184KB
MD5

cebd6ed15ef1424014298188c69e87cb
SHA1

1f636b67f6fb6b5a3c12293648e2f3f05f1a02f3
SHA256

1149594eebfbb939fa4c36c7f88c3123209d30be43c064bcb71057ccf9c874ab
SHA512

94004ef2599a2a13ceb016df27ecfcd061d188800426aeeb65af5e10c5646ed1e84e6c41cfe8ea69db45008335032226043eb00bd60bd74455840c1e58974577

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 776 wrote to memory of 2020	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 2020	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 2020	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 2020	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 2020	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 2020	776	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 2020	776	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1149594eebfbb939fa4c36c7f88c3123209d30be43c064bcb71057ccf9c874ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1149594eebfbb939fa4c36c7f88c3123209d30be43c064bcb71057ccf9c874ab.dll,#1
2⤵
PID:2020

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-2-0x0000000000000000-mapping.dmp

Download
memory/2020-3-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download