6df88e26b94be01b9a7abcd8473f74b9ea7278282421da4bf7dbffa6a53a2a58 | Triage

Analysis

max time kernel
110s
max time network
111s
platform
windows10_x64
resource
win10v20201028
submitted
24-03-2021 17:35

Sharing

Report Analysis Logs

General

Target

330000.dll
Size

150KB
MD5

4209e752839b142cc328261ba570b0d2
SHA1

275a712c823e2a5935145c418d2fe2abe38d2eba
SHA256

6df88e26b94be01b9a7abcd8473f74b9ea7278282421da4bf7dbffa6a53a2a58
SHA512

0b6f903f10f4c1e523f87fc5e5a64c173ab112833748e11d13efed049801d5381aff4139cf3e852c24c25f7049b98a2af16549594ea3ceafe698ae1fc0b692ba

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4708 wrote to memory of 4732	4708	rundll32.exe	rundll32.exe
PID 4708 wrote to memory of 4732	4708	rundll32.exe	rundll32.exe
PID 4708 wrote to memory of 4732	4708	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\330000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\330000.dll,#1
2⤵
PID:4732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4732-2-0x0000000000000000-mapping.dmp

Download