651c87fba47898d7f3294e1f3dc355ee7f857c8e3e2cdeba4e8d3154227fe942 | Triage™

Analysis

max time kernel
19s
max time network
8s
platform
windows7_x64
resource
win7v20210410
submitted
29/04/2021, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0c295416_by_Libranalysis.dll
Size 162KB
Sample210429-dvk8scrtwe
SHA256 651c87fba47898d7f3294e1f3dc355ee7f857c8e3e2cdeba4e8d3154227fe942
MD5 0c295416da344768722ee2fff5d4bd3c
SHA1 ad316fdc8cc1b407424555c9b924e87673af8cc0
SHA512 148314d14af5d9c7456b31197bef0a7039e9d35544548737acecac314f44444f4dcde977e617ab4742b874b85f388aae70653ae96748ea5c6d938c0a1df812cc
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1192	1084	rundll32.exe	25
PID 1084 wrote to memory of 1192	1084	rundll32.exe	25
PID 1084 wrote to memory of 1192	1084	rundll32.exe	25
PID 1084 wrote to memory of 1192	1084	rundll32.exe	25
PID 1084 wrote to memory of 1192	1084	rundll32.exe	25
PID 1084 wrote to memory of 1192	1084	rundll32.exe	25
PID 1084 wrote to memory of 1192	1084	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c295416_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c295416_by_Libranalysis.dll,#1
  2⤵
  PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-60-0x00000000752F1000-0x00000000752F3000-memory.dmp

Download