3b8dd3bc950e31064f5fe058ed3e8c25f082bef1f42e1426760cc6f8fef14821 | Triage™

Analysis

max time kernel
28s
max time network
114s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 20:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b8dd3bc950e31064f5fe058ed3e8c25f082bef1f42e1.dll
Size 19KB
Sample210331-5qg4ftcapj
SHA256 3b8dd3bc950e31064f5fe058ed3e8c25f082bef1f42e1426760cc6f8fef14821
MD5 1e3d729aefe43012af8f4b8d4ae78c64
SHA1 9ce0416256b3b41df4015c5df56122790fd93ca5
SHA512 cdbb91e799a119cd3f6b9b09bec294607fd0d456baffc16adb9d02231a5a0a1bb031018da5e6e16bf4ecfa6e8fd408f5e95eeab42c0472109aa0e96a80a2bb44
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\edge.job	notepad.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4808	4648	rundll32.exe	38
PID 4648 wrote to memory of 4808	4648	rundll32.exe	38
PID 4648 wrote to memory of 4808	4648	rundll32.exe	38
PID 4648 wrote to memory of 4808	4648	rundll32.exe	38
PID 4648 wrote to memory of 4808	4648	rundll32.exe	38

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b8dd3bc950e31064f5fe058ed3e8c25f082bef1f42e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  - Drops file in Windows directory
  PID:4808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4808-2-0x0000023ACD410000-0x0000023ACD413000-memory.dmp

Download