ab008ebf48d745343ceb220831f7c90dbc9bb75df422100cb8a60d57de13a1bb | Triage

Analysis

max time kernel
16s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
30-03-2021 11:37

Sharing

Report Analysis Logs

General

Target

cb0cbf5026d0221243179a81580df6d35347ed381a2e1ac002bec6bc3f500b80.dll
Size

565KB
MD5

b5fc16e8160db85f71a1998835b3b804
SHA1

7ac6baadea179f4ab80f1f644ec3a236d69e6925
SHA256

cb0cbf5026d0221243179a81580df6d35347ed381a2e1ac002bec6bc3f500b80
SHA512

3c42fe9dc7fac27368c198282f667c249bd5cb4b6677d9ba320081da8ef1f50a332c20a462b2755eedbb8b0bb22effd6b8ae8c536e939c9ec5f5a931215d6e3f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 68 wrote to memory of 1112	68	rundll32.exe	rundll32.exe
PID 68 wrote to memory of 1112	68	rundll32.exe	rundll32.exe
PID 68 wrote to memory of 1112	68	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb0cbf5026d0221243179a81580df6d35347ed381a2e1ac002bec6bc3f500b80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:68

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb0cbf5026d0221243179a81580df6d35347ed381a2e1ac002bec6bc3f500b80.dll,#1
2⤵
PID:1112

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-2-0x0000000000000000-mapping.dmp

Download