a353dfb1b5eb69808244356cf9a784181c53eea2cb3f254749fa19c307c30cfc | Triage™

Analysis

max time kernel
12s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 08:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a353dfb1b5eb69808244356cf9a784181c53eea2cb3f254749fa19c307c30cfc.dll
Size 68KB
Sample210331-z7jqder97n
SHA256 a353dfb1b5eb69808244356cf9a784181c53eea2cb3f254749fa19c307c30cfc
MD5 08872d5cfea82b5e0ccbea0392013acc
SHA1 fff6a5844df8e60213214fbbe687e86fd2d34a93
SHA512 34232c94f92f491f0ee73717a4ca4df339adc74ff0bf2b1e7fe24d4f4ba015dba7f91b03c2becfa196d32967d0ab204086a894b26d43f251a96cbbe1563b8ede
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 1216	3116	rundll32.exe	71
PID 3116 wrote to memory of 1216	3116	rundll32.exe	71
PID 3116 wrote to memory of 1216	3116	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a353dfb1b5eb69808244356cf9a784181c53eea2cb3f254749fa19c307c30cfc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a353dfb1b5eb69808244356cf9a784181c53eea2cb3f254749fa19c307c30cfc.dll,#1
  2⤵
  PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads