b3de1118d6c87e6a1dfb9cc39e01073c8dc7af9057a60e03d7f168182700dc19 | Triage

Analysis

max time kernel
58s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
02-03-2021 11:05

Sharing

Report Analysis Logs

General

Target

bd8fb3c8abf97cdd741af7e8fd921a3b5d4a1efde9490933e405baa8f5226101.dll
Size

357KB
MD5

9fc59f68d528d95e13a706e6f5c8cc9d
SHA1

64b3489a39907d5a8adc8fabf18afeb6f573a97e
SHA256

bd8fb3c8abf97cdd741af7e8fd921a3b5d4a1efde9490933e405baa8f5226101
SHA512

a1e5df2e959ced5b4d16bfbbef512e2129e3d82e4fd799ad6e24728a29903617b54a1c7af322215a5899ab03cd51f17eaa8e57a27644398c8a08e42c42cf3712

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4768 wrote to memory of 4840	4768	rundll32.exe	rundll32.exe
PID 4768 wrote to memory of 4840	4768	rundll32.exe	rundll32.exe
PID 4768 wrote to memory of 4840	4768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd8fb3c8abf97cdd741af7e8fd921a3b5d4a1efde9490933e405baa8f5226101.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4768

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd8fb3c8abf97cdd741af7e8fd921a3b5d4a1efde9490933e405baa8f5226101.dll,#1
2⤵
PID:4840

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
PID:3300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3300-5-0x0000000000000000-mapping.dmp

Download
memory/3300-6-0x0000000002C30000-0x0000000002C56000-memory.dmp

Filesize
152KB

Download
memory/4840-2-0x0000000000000000-mapping.dmp

Download
memory/4840-3-0x0000000002BC0000-0x0000000002BE2000-memory.dmp

Filesize
136KB

Download
memory/4840-4-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download