0a87bd3bb60320b21e493341b70519af4e46c2e969038d6d89b536cd37aa11d9 | Triage

Analysis

max time kernel
21s
max time network
12s
platform
windows7_x64
resource
win7v20210408
submitted
06-05-2021 15:20

Sharing

Report Analysis Logs

General

Target

vegas.dll
Size

513KB
MD5

b80f4b91c29963df1cfd0d0a8a30e5c6
SHA1

09c6ae06e0c10672d91f6850118f41dc3dd66e72
SHA256

0a87bd3bb60320b21e493341b70519af4e46c2e969038d6d89b536cd37aa11d9
SHA512

bdcd3009ed3499055cf73ef1c4dd4bd0942c8b81c395cecf3c9da790e4867055059d10b05451476d7da98bbbf472c40536e7a09158b5de92c57a74e36396d10c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 736 wrote to memory of 1752	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1752	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1752	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1752	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1752	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1752	736	rundll32.exe	rundll32.exe
PID 736 wrote to memory of 1752	736	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vegas.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vegas.dll,#1
2⤵
PID:1752

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-60-0x0000000000000000-mapping.dmp

Download
memory/1752-61-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/1752-62-0x0000000074B90000-0x0000000074BB8000-memory.dmp

Filesize
160KB

Download
memory/1752-63-0x0000000074B90000-0x0000000074D1C000-memory.dmp

Filesize
1.5MB

Download
memory/1752-64-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download