c1f477a697c1a9536b221be61c521fed9af1c4e97c74e6ead846a900c017e987 | Triage

Analysis

max time kernel
23s
max time network
24s
platform
windows7_x64
resource
win7v20201028
submitted
23-02-2021 12:43

Sharing

Report Analysis Logs

General

Target

c1f477a697c1a9536b221be61c521fed9af1c4e97c74e6ead846a900c017e987.dll
Size

184KB
MD5

642685d268be8eae83580bce1c96ac8e
SHA1

8f1116490445250ed9df55ebdc5ce02fbe96fd17
SHA256

c1f477a697c1a9536b221be61c521fed9af1c4e97c74e6ead846a900c017e987
SHA512

564e455cd9f37412513da10fdcf645dd1b5e5180f8ece6b3a99723541646ae672b150e5d23de3e6742326d28b935e3d2001952460c0dfda1f3619dd89e126ab7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1944 wrote to memory of 2040	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2040	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2040	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2040	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2040	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2040	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 2040	1944	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1f477a697c1a9536b221be61c521fed9af1c4e97c74e6ead846a900c017e987.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1f477a697c1a9536b221be61c521fed9af1c4e97c74e6ead846a900c017e987.dll,#1
2⤵
PID:2040

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-2-0x0000000000000000-mapping.dmp

Download
memory/2040-3-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download