5e17489f14290da984483c3671679c43368150cf7fd7791a47bf71733b2d5de4 | Triage

Analysis

max time kernel
2s
max time network
8s
platform
windows7_x64
resource
win7v20210410
submitted
21-04-2021 13:57

Sharing

Report Analysis Logs

General

Target

5e17489f14290da984483c3671679c43368150cf7fd7791a47bf71733b2d5de4.dll
Size

162KB
MD5

5526a759ba7b270b9c4197e8501efdaf
SHA1

1b9631d67d9a5c31036046d93b2c83be10d7d968
SHA256

5e17489f14290da984483c3671679c43368150cf7fd7791a47bf71733b2d5de4
SHA512

5587f5b4c4820ccbcd5689b2317abc6d6fd886f9264b876b664ec551f805355ca2c3aee4caf8e9ca47ac8b1c4571ff783d04b5ca4ea8340a8965b00dd307a1e4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1420 wrote to memory of 2028	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 2028	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 2028	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 2028	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 2028	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 2028	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 2028	1420	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e17489f14290da984483c3671679c43368150cf7fd7791a47bf71733b2d5de4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e17489f14290da984483c3671679c43368150cf7fd7791a47bf71733b2d5de4.dll,#1
2⤵
PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-60-0x0000000000000000-mapping.dmp

Download
memory/2028-61-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download