ab008ebf48d745343ceb220831f7c90dbc9bb75df422100cb8a60d57de13a1bb | Triage

Analysis

max time kernel
8s
max time network
18s
platform
windows7_x64
resource
win7v20201028
submitted
30-03-2021 11:37

Sharing

Report Analysis Logs

General

Target

80e8788a7fc1925d62517ee3f0c7d161a5bb89a8e93f22d007e4c1203952c905.dll
Size

565KB
MD5

9ef5a01a86d87de851e57609f26783ba
SHA1

5cdc0a212d5f83d9f03d74ba6fd442e7e47a7182
SHA256

80e8788a7fc1925d62517ee3f0c7d161a5bb89a8e93f22d007e4c1203952c905
SHA512

392ffd8685528fe0bac795f6382d4790cc3a3e00078cfa90c5352b210cb1b013358b17612b2e4c1d8f5c96dd24e40007c805b7f8e9ae7aef2cbceb1a32c37ccf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1832 wrote to memory of 1960	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1960	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1960	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1960	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1960	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1960	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1960	1832	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80e8788a7fc1925d62517ee3f0c7d161a5bb89a8e93f22d007e4c1203952c905.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80e8788a7fc1925d62517ee3f0c7d161a5bb89a8e93f22d007e4c1203952c905.dll,#1
2⤵
PID:1960

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-2-0x0000000000000000-mapping.dmp

Download
memory/1960-3-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download