ab008ebf48d745343ceb220831f7c90dbc9bb75df422100cb8a60d57de13a1bb | Triage

Analysis

max time kernel
13s
max time network
104s
platform
windows10_x64
resource
win10v20201028
submitted
30-03-2021 11:37

Sharing

Report Analysis Logs

General

Target

9ccf017ae49bab69354c3d0c4625b0286450b637c8d71dc1aec1022fc576b532.dll
Size

8.1MB
MD5

7f52e8a6d78aedb8345e4310c52770eb
SHA1

b2d0ba5c82c9d46a005bc54526754237caacc9d8
SHA256

9ccf017ae49bab69354c3d0c4625b0286450b637c8d71dc1aec1022fc576b532
SHA512

618cf06977d4ae2ce38562201426eb747c120fbf26e12a5c773f7bde42f2470b37a5acdfe7a1d4f71525eebf2f507be8e13524d1fa794639292fe7addac59e7d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4772 wrote to memory of 4876	4772	rundll32.exe	rundll32.exe
PID 4772 wrote to memory of 4876	4772	rundll32.exe	rundll32.exe
PID 4772 wrote to memory of 4876	4772	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ccf017ae49bab69354c3d0c4625b0286450b637c8d71dc1aec1022fc576b532.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ccf017ae49bab69354c3d0c4625b0286450b637c8d71dc1aec1022fc576b532.dll,#1
2⤵
PID:4876

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4876-2-0x0000000000000000-mapping.dmp

Download