25b794ff88d3fba4b4c8199ac89871ff377f8c99577ec3733dcbd4d98fb7b980 | Triage™

Analysis

max time kernel
25s
max time network
11s
platform
windows7_x64
resource
win7v20210410
submitted
08/05/2021, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ad08f9ae_by_Libranalysis.dll
Size 162KB
Sample210508-l7n2xamdpx
SHA256 25b794ff88d3fba4b4c8199ac89871ff377f8c99577ec3733dcbd4d98fb7b980
MD5 ad08f9ae17ff23c919b9504945422799
SHA1 d2e24923e85807622acf9b47b0a7d44e8c12bda9
SHA512 288bb49b0bb9d843df08d950dbe255ba566df2a87d39e5b27e2507e36b46b4f6be0b6ec8b150da72940c6288344032410bc0388e6d43b5d3750365edddadc622
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 1688	484	rundll32.exe	7
PID 484 wrote to memory of 1688	484	rundll32.exe	7
PID 484 wrote to memory of 1688	484	rundll32.exe	7
PID 484 wrote to memory of 1688	484	rundll32.exe	7
PID 484 wrote to memory of 1688	484	rundll32.exe	7
PID 484 wrote to memory of 1688	484	rundll32.exe	7
PID 484 wrote to memory of 1688	484	rundll32.exe	7

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad08f9ae_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad08f9ae_by_Libranalysis.dll,#1
  2⤵
  PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-60-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Download