0d5cc8c23f947379e847033dbe1cc4ecc5d5d5f54b56a73d9833d40154e9cd23 | Triage

Analysis

max time kernel
16s
max time network
67s
platform
windows10_x64
resource
win10v20201028
submitted
24-03-2021 16:59

Sharing

Report Analysis Logs

General

Target

434c89ee9f413c1455992b6a9b0c67b6.dll
Size

688KB
MD5

434c89ee9f413c1455992b6a9b0c67b6
SHA1

8ae47bd241b56e4ffa340b09e3fe590775f87efc
SHA256

0d5cc8c23f947379e847033dbe1cc4ecc5d5d5f54b56a73d9833d40154e9cd23
SHA512

96226c34ab487f995d12ec099e7c53402fd39be5675e50a8f26db875329e0666581a9574dac0aa030451d21e83cd20a2e928fee3b3cad3daa3343009b018ba1b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1152 wrote to memory of 1320	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1320	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1320	1152	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\434c89ee9f413c1455992b6a9b0c67b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\434c89ee9f413c1455992b6a9b0c67b6.dll,#1
2⤵
PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-2-0x0000000000000000-mapping.dmp

Download
memory/1320-3-0x0000000004081000-0x00000000040EF000-memory.dmp

Filesize
440KB

Download
memory/1320-4-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download