a353dfb1b5eb69808244356cf9a784181c53eea2cb3f254749fa19c307c30cfc | Triage

Analysis

max time kernel
12s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
31-03-2021 08:17

Sharing

Report Analysis Logs

General

Target

a353dfb1b5eb69808244356cf9a784181c53eea2cb3f254749fa19c307c30cfc.dll
Size

68KB
MD5

08872d5cfea82b5e0ccbea0392013acc
SHA1

fff6a5844df8e60213214fbbe687e86fd2d34a93
SHA256

a353dfb1b5eb69808244356cf9a784181c53eea2cb3f254749fa19c307c30cfc
SHA512

34232c94f92f491f0ee73717a4ca4df339adc74ff0bf2b1e7fe24d4f4ba015dba7f91b03c2becfa196d32967d0ab204086a894b26d43f251a96cbbe1563b8ede

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3116 wrote to memory of 1216	3116	rundll32.exe	rundll32.exe
PID 3116 wrote to memory of 1216	3116	rundll32.exe	rundll32.exe
PID 3116 wrote to memory of 1216	3116	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a353dfb1b5eb69808244356cf9a784181c53eea2cb3f254749fa19c307c30cfc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a353dfb1b5eb69808244356cf9a784181c53eea2cb3f254749fa19c307c30cfc.dll,#1
2⤵
PID:1216

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-2-0x0000000000000000-mapping.dmp

Download