Overview

overview

10

Static

static

8

0032588b8d...091.js

windows7_x64

1

0032588b8d...091.js

windows10_x64

1

09002c686e...2b.exe

windows7_x64

10

09002c686e...2b.exe

windows10_x64

10

0b1551c0be...16.exe

windows7_x64

1

0b1551c0be...16.exe

windows10_x64

1

1048caa70a...29.exe

windows7_x64

10

1048caa70a...29.exe

windows10_x64

10

1c3170b776...b0.exe

windows7_x64

3

1c3170b776...b0.exe

windows10_x64

3

240387329d...62.exe

windows7_x64

1

240387329d...62.exe

windows10_x64

1

2573b35645...9a.exe

windows7_x64

10

2573b35645...9a.exe

windows10_x64

10

2df6c36b47...51.exe

windows7_x64

7

2df6c36b47...51.exe

windows10_x64

7

2df6c36b47...1).exe

windows7_x64

7

2df6c36b47...1).exe

windows10_x64

7

2e4319ff62...8b.dll

windows7_x64

1

2e4319ff62...8b.dll

windows10_x64

3

2fba2aba4b...07.exe

windows7_x64

1

2fba2aba4b...07.exe

windows10_x64

1

3ed5d687a4...bd.exe

windows7_x64

3

3ed5d687a4...bd.exe

windows10_x64

3

4fc17a5cf8...d5.exe

windows7_x64

6

4fc17a5cf8...d5.exe

windows10_x64

6

5942a02bc0...d3.dll

windows7_x64

10

5942a02bc0...d3.dll

windows10_x64

10

6e7785213d...3d.exe

windows7_x64

8

6e7785213d...3d.exe

windows10_x64

8

83c64ed85d...a0.exe

windows7_x64

10

83c64ed85d...a0.exe

windows10_x64

10

Analysis

  • max time kernel
    104s
  • max time network
    12s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    15-03-2021 09:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2e4319ff62c03a539b2b2f71768a0cfc0adcaedbcca69dbf235081fe2816248b.dll

  • Size

    181KB

  • MD5

    0826df3aaa157edff9c0325f298850c2

  • SHA1

    ed35b02fa029f1e724ed65c2de5de6e5c04f7042

  • SHA256

    2e4319ff62c03a539b2b2f71768a0cfc0adcaedbcca69dbf235081fe2816248b

  • SHA512

    af6c5734fd02b9ad3f202e95f9ff4368cf0dfdaffe0d9a88b781b196a0a3c44eef3d8f7c329ec6e3cbcd3e6ab7c49df7d715489539e631506ca1ae476007a6a6

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e4319ff62c03a539b2b2f71768a0cfc0adcaedbcca69dbf235081fe2816248b.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e4319ff62c03a539b2b2f71768a0cfc0adcaedbcca69dbf235081fe2816248b.dll,#1
      2⤵
        PID:1628

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1628-3-0x0000000075EB1000-0x0000000075EB3000-memory.dmp

      Filesize

      8KB

      Download