95369b6da537cc89637e9c2790c455e94e2d3aadf4795b8a51d1c1f120f7a44b | Triage

Analysis

max time kernel
23s
max time network
25s
platform
windows7_x64
resource
win7v20201028
submitted
23-02-2021 12:38

Sharing

Report Analysis Logs

General

Target

95369b6da537cc89637e9c2790c455e94e2d3aadf4795b8a51d1c1f120f7a44b.dll
Size

184KB
MD5

92c7f24a3f607989cc1d11deefe4a412
SHA1

beddd98b454fb084696d24e2e9fb6ea4fa4afc1a
SHA256

95369b6da537cc89637e9c2790c455e94e2d3aadf4795b8a51d1c1f120f7a44b
SHA512

dd2a859bdd41331d3b9762ab827f42c004f606e3325c0e0ff3014ee824416754bd3ce9319a4f3ef16f1d3317b9e26a314f0797215fec5d6e023f686443fd82af

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1596 wrote to memory of 2024	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 2024	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 2024	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 2024	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 2024	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 2024	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 2024	1596	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95369b6da537cc89637e9c2790c455e94e2d3aadf4795b8a51d1c1f120f7a44b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95369b6da537cc89637e9c2790c455e94e2d3aadf4795b8a51d1c1f120f7a44b.dll,#1
2⤵
PID:2024

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2024-2-0x0000000000000000-mapping.dmp

Download
memory/2024-3-0x0000000075781000-0x0000000075783000-memory.dmp

Filesize
8KB

Download