9023b7eae74aebca48f7861fd3d9f971b584d4ebc8ae14219fc7bac2721f2d98 | Triage™

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7v20210410
submitted
07/05/2021, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ed7fb93_by_Libranalysis.dll
Size 162KB
Sample210507-xbfezaadfa
SHA256 9023b7eae74aebca48f7861fd3d9f971b584d4ebc8ae14219fc7bac2721f2d98
MD5 6ed7fb93b9b08e6786e8b6339d682400
SHA1 796374e348b5d0f5abb100f114a37f71f81716e2
SHA512 c9486bd258c0aaae3f0b060236fd732e705dae4627b3f350d99abbb5f930977e68e541a46b7a69e7ad4592805108209264f46bb28b0e57d0d2c771788b514b6a
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1612	1268	rundll32.exe	20
PID 1268 wrote to memory of 1612	1268	rundll32.exe	20
PID 1268 wrote to memory of 1612	1268	rundll32.exe	20
PID 1268 wrote to memory of 1612	1268	rundll32.exe	20
PID 1268 wrote to memory of 1612	1268	rundll32.exe	20
PID 1268 wrote to memory of 1612	1268	rundll32.exe	20
PID 1268 wrote to memory of 1612	1268	rundll32.exe	20

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ed7fb93_by_Libranalysis.dll,#1
1⤵
PID:1612

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ed7fb93_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-60-0x0000000075591000-0x0000000075593000-memory.dmp

Download