079ebee56fd7d5f4431f39d39637e1af3f8a1f62a7f83c1523d87f503bedeccc | Triage™

Analysis

max time kernel
28s
max time network
13s
platform
windows7_x64
resource
win7v20210410
submitted
03/05/2021, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c2a4a1c9_by_Libranalysis.dll
Size 162KB
Sample210503-e4l2f5hxw6
SHA256 079ebee56fd7d5f4431f39d39637e1af3f8a1f62a7f83c1523d87f503bedeccc
MD5 c2a4a1c98abbfd49d48c18158da5a630
SHA1 01594f9637efb43480fd93af449322d182989756
SHA512 7177a7d871b609bdf36393b3ea28c421524eb09b42d0457c7717f2cb5216d0194381e19f9b9429e49d39148aec89fdeb50af9751ece31ca0c0ad3bf1d6693ad0
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1988	752	rundll32.exe	26
PID 752 wrote to memory of 1988	752	rundll32.exe	26
PID 752 wrote to memory of 1988	752	rundll32.exe	26
PID 752 wrote to memory of 1988	752	rundll32.exe	26
PID 752 wrote to memory of 1988	752	rundll32.exe	26
PID 752 wrote to memory of 1988	752	rundll32.exe	26
PID 752 wrote to memory of 1988	752	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2a4a1c9_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2a4a1c9_by_Libranalysis.dll,#1
  2⤵
  PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-60-0x0000000076661000-0x0000000076663000-memory.dmp

Download