ab008ebf48d745343ceb220831f7c90dbc9bb75df422100cb8a60d57de13a1bb | Triage

Analysis

max time kernel
3s
max time network
13s
platform
windows7_x64
resource
win7v20201028
submitted
30-03-2021 11:37

Sharing

Report Analysis Logs

General

Target

16b04fe2674ddd0fa8722fbd69a1b37620c69385ba9e3811faa3b66734c2fab7.dll
Size

8.2MB
MD5

5331b83173e4db5f8776b034ee7ca346
SHA1

2395e203eef4213ec01f4d26ba207940d9ebb680
SHA256

16b04fe2674ddd0fa8722fbd69a1b37620c69385ba9e3811faa3b66734c2fab7
SHA512

7b5d6fa5e59330b517fd08c3acc81a9936377ccf0f68309492b542dc1803bfc652df8b6bd101c45785ad14a8efcd0a7102f0405f2570ca3c7835e240840b70a8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1100 wrote to memory of 1068	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1068	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1068	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1068	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1068	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1068	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 1068	1100	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16b04fe2674ddd0fa8722fbd69a1b37620c69385ba9e3811faa3b66734c2fab7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16b04fe2674ddd0fa8722fbd69a1b37620c69385ba9e3811faa3b66734c2fab7.dll,#1
2⤵
PID:1068

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1068-3-0x00000000765E1000-0x00000000765E3000-memory.dmp

Filesize
8KB

Download
memory/1068-2-0x0000000000000000-mapping.dmp

Download