8cb686e3865e02e2b93a6c73ccf6c3dfd4bb0a3efa1e1de08c93d20cf00387e2 | Triage™

Analysis

max time kernel
133s
max time network
137s
platform
windows7_x64
resource
win7v20210410
submitted
29/04/2021, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
56dcc7e5_by_Libranalysis.dll
Size 162KB
Sample210429-ykh6lt332n
SHA256 8cb686e3865e02e2b93a6c73ccf6c3dfd4bb0a3efa1e1de08c93d20cf00387e2
MD5 56dcc7e59560e96b83b8fefa6250a76e
SHA1 5e3a10fc7b29c7b46413099441a140ae36c4482c
SHA512 aa1b63c0859b50b5d4691d4d989d1431c0071d55fb36a1a04f7b9ddacd109dc46c3611fbc7192617345ada4dbf48f3a28b118be2e017dbc4991211adfff3358a
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2008	1096	rundll32.exe	26
PID 1096 wrote to memory of 2008	1096	rundll32.exe	26
PID 1096 wrote to memory of 2008	1096	rundll32.exe	26
PID 1096 wrote to memory of 2008	1096	rundll32.exe	26
PID 1096 wrote to memory of 2008	1096	rundll32.exe	26
PID 1096 wrote to memory of 2008	1096	rundll32.exe	26
PID 1096 wrote to memory of 2008	1096	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56dcc7e5_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56dcc7e5_by_Libranalysis.dll,#1
  2⤵
  PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-61-0x0000000075281000-0x0000000075283000-memory.dmp

Download