8291e91832cb83c9d91248e676fb207b8ad730df7904b1afb5856c87e1bbf554 | Triage™

Analysis

max time kernel
123s
max time network
124s
platform
windows7_x64
resource
win7v20210410
submitted
03/05/2021, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
83a342ff_by_Libranalysis.dll
Size 162KB
Sample210503-flap3cv7ne
SHA256 8291e91832cb83c9d91248e676fb207b8ad730df7904b1afb5856c87e1bbf554
MD5 83a342ff97de8f2740fc11a41bdafd2b
SHA1 9a061df07a344bb5ae53985837892e4534c8e24a
SHA512 282812b4564f7df39c338746feafd0c719a5f57744daf59472ee484e7b38332bd10e271629a32cc6167ec5f6f51222d6c72aae8a85bc5db02af2d0fc0943a8b1
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2004	1872	rundll32.exe	25
PID 1872 wrote to memory of 2004	1872	rundll32.exe	25
PID 1872 wrote to memory of 2004	1872	rundll32.exe	25
PID 1872 wrote to memory of 2004	1872	rundll32.exe	25
PID 1872 wrote to memory of 2004	1872	rundll32.exe	25
PID 1872 wrote to memory of 2004	1872	rundll32.exe	25
PID 1872 wrote to memory of 2004	1872	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83a342ff_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\83a342ff_by_Libranalysis.dll,#1
  2⤵
  PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-61-0x0000000075631000-0x0000000075633000-memory.dmp

Download