ab008ebf48d745343ceb220831f7c90dbc9bb75df422100cb8a60d57de13a1bb | Triage

Analysis

max time kernel
20s
max time network
68s
platform
windows10_x64
resource
win10v20201028
submitted
30-03-2021 11:37

Sharing

Report Analysis Logs

General

Target

ebd5039cce22ae8a299533fe2350fc170763e7a7fe3c315ca417865ab086a019.dll
Size

565KB
MD5

50fd43d2dbf117c5e88a869b4a9b1981
SHA1

06c17c31d69068dafa612efadb901adb3dbe330c
SHA256

ebd5039cce22ae8a299533fe2350fc170763e7a7fe3c315ca417865ab086a019
SHA512

176d123a488bcc3664f21e926855f1e78f78c60987563ccca4fe9ddf290d7be915fa82d93d2e4bd434f1fdeec85843df37e7c458da826d32461c9af870d9773f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1456 wrote to memory of 2664	1456	rundll32.exe	rundll32.exe
PID 1456 wrote to memory of 2664	1456	rundll32.exe	rundll32.exe
PID 1456 wrote to memory of 2664	1456	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebd5039cce22ae8a299533fe2350fc170763e7a7fe3c315ca417865ab086a019.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebd5039cce22ae8a299533fe2350fc170763e7a7fe3c315ca417865ab086a019.dll,#1
2⤵
PID:2664

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-2-0x0000000000000000-mapping.dmp

Download