61be79c9e47ad894006907c544c0a2d606d8d69c95298ffc5861f20c4b87769e | Triage

Analysis

max time kernel
142s
max time network
142s
platform
windows10_x64
resource
win10v20201028
submitted
24-03-2021 17:11

Sharing

Report Analysis Logs

General

Target

xiNGRHX.txt.dll
Size

688KB
MD5

bb4d1959e6a7850a556ebadf69d18508
SHA1

c4a940aa768e97da36393a899775ff7172f66274
SHA256

61be79c9e47ad894006907c544c0a2d606d8d69c95298ffc5861f20c4b87769e
SHA512

57c6e278ca830b5d20ab0d6a442cfca2265abffa5f46f40c4551e22a0acafef0b0a9fe06b08848bc58dfd5e7e5327ccc4c684edb60204cbcc5a839a9bbbe0a0d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3116 wrote to memory of 812	3116	rundll32.exe	rundll32.exe
PID 3116 wrote to memory of 812	3116	rundll32.exe	rundll32.exe
PID 3116 wrote to memory of 812	3116	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xiNGRHX.txt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xiNGRHX.txt.dll,#1
2⤵
PID:812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-2-0x0000000000000000-mapping.dmp

Download
memory/812-3-0x00000000049E1000-0x0000000004A4F000-memory.dmp

Filesize
440KB

Download
memory/812-4-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download