b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f | Triage

Analysis

max time kernel
33s
max time network
9s
platform
windows7_x64
resource
win7v20201028
submitted
28-03-2021 01:34

Sharing

Report Analysis Logs

General

Target

b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll
Size

298KB
MD5

a80859c1cd44daad1450948a1276bc0d
SHA1

46396892b9cafb2e59b8f667ec7822d0435384bb
SHA256

b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f
SHA512

ce68470318b8472b30aeee8778802ca4c9175f075a9c19c8332a08a6a8518a2f157a9e2ccaedba1d42f83f591d3c5f233ee1b8b8fbb90589aae82c9dea68352c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1656 wrote to memory of 1960	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1960	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1960	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1960	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1960	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1960	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1960	1656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b270e245132cf6624fc96642532a00c0a16681f59542220ad2c389d45865141f.dll,#1
2⤵
PID:1960

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-2-0x0000000000000000-mapping.dmp

Download
memory/1960-3-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download
memory/1960-4-0x0000000075220000-0x000000007524B000-memory.dmp

Filesize
172KB

Download
memory/1960-5-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download