ab008ebf48d745343ceb220831f7c90dbc9bb75df422100cb8a60d57de13a1bb | Triage

Analysis

max time kernel
13s
max time network
105s
platform
windows10_x64
resource
win10v20201028
submitted
30-03-2021 11:37

Sharing

Report Analysis Logs

General

Target

6ba6d85cc30a01fca2719e0a11fa6c44c850c4c6bf8d57d30e5ed3665937aead.dll
Size

565KB
MD5

b290af98982337a97ffab918cac94814
SHA1

503feee18a349aaf4d9bdb7317f1a87ff00af884
SHA256

6ba6d85cc30a01fca2719e0a11fa6c44c850c4c6bf8d57d30e5ed3665937aead
SHA512

fc7a80592b49bb74d8c82186055d2369ce9a223b7de702d12c2e86ac9cb2e44b36f369048d8beb74effbda53f1a9abcdf91c5fcac450ff5b6da8d762862efe31

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1056 wrote to memory of 1408	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1408	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 1408	1056	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ba6d85cc30a01fca2719e0a11fa6c44c850c4c6bf8d57d30e5ed3665937aead.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ba6d85cc30a01fca2719e0a11fa6c44c850c4c6bf8d57d30e5ed3665937aead.dll,#1
2⤵
PID:1408

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-2-0x0000000000000000-mapping.dmp

Download