c678c05b05790006e56a25659eaa97520f426c6b2bbd7ccfb3ea30cc46d672f9 | Triage

Resubmissions

14-04-2021 18:41

210414-79n4fetnh2 10

03-03-2021 13:07

210303-63ttyvvd12 10

Analysis

max time kernel
2s
max time network
9s
platform
windows7_x64
resource
win7v20201028
submitted
03-03-2021 13:07

Sharing

Report Analysis Logs

General

Target

c678c05b05790006e56a25659eaa97520f426c6b2bbd7ccfb3ea30cc46d672f9.dll
Size

164KB
MD5

6a85fe97ccaa29d09e5df824d4eaad59
SHA1

1a21c93de1af252f9c293e4a39e63bc2775d2b02
SHA256

c678c05b05790006e56a25659eaa97520f426c6b2bbd7ccfb3ea30cc46d672f9
SHA512

a0c2749249ecdd4dd42389df8c89110ad1d0473a2b69f8aaf142a9b9faf5f6797231c49a060f534834fa69fe66a7aef85c7c02e5c4c121fbe118d0a93d8b9fff

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1684 wrote to memory of 1104	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1104	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1104	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1104	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1104	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1104	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1104	1684	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c678c05b05790006e56a25659eaa97520f426c6b2bbd7ccfb3ea30cc46d672f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c678c05b05790006e56a25659eaa97520f426c6b2bbd7ccfb3ea30cc46d672f9.dll,#1
2⤵
PID:1104

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-3-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1104-2-0x0000000000000000-mapping.dmp

Download
memory/1104-6-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1104-5-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1104-4-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download