0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402 | Triage

Analysis

max time kernel
2s
max time network
10s
platform
windows7_x64
resource
win7v20210410
submitted
05-05-2021 11:03

Sharing

Report Analysis Logs

General

Target

040818b1_by_Libranalysis.dll
Size

813KB
MD5

040818b1b3c9b1bf8245f5bcb4eebbbc
SHA1

c0f569fc22cb5dd8e02e44f85168b4b72a6669c3
SHA256

0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402
SHA512

bf4dcfb3c7cac05776560e751414a8babfa25fb8703768d0264133d4964f841055cfcab9f30d9854e422642855b4452b9fbf431889cb70a37ecbca7564f638c1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1088 wrote to memory of 1948	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1948	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1948	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1948	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1948	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1948	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1948	1088	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\040818b1_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\040818b1_by_Libranalysis.dll,#1
2⤵
PID:1948

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-60-0x0000000000000000-mapping.dmp

Download
memory/1948-61-0x0000000076E11000-0x0000000076E13000-memory.dmp

Filesize
8KB

Download
memory/1948-62-0x0000000000200000-0x0000000000221000-memory.dmp

Filesize
132KB

Download