b9b8f3f89933ffa376b3349232fda67789173c3e710291f2f020751b82e32e89 | Triage™

Analysis

max time kernel
31s
max time network
13s
platform
windows7_x64
resource
win7v20210408
submitted
08/05/2021, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85835671_by_Libranalysis.dll
Size 162KB
Sample210508-sgewadayxe
SHA256 b9b8f3f89933ffa376b3349232fda67789173c3e710291f2f020751b82e32e89
MD5 8583567183ab346595737db81d44be66
SHA1 cd8b96a0887e78023cac89e8c52595d05acfea4e
SHA512 f8052eefecbbd1d0ec75464470d9339866e440ccd1d562df47e6b2b46c18da674b400794e7123c59f44b5acd90527eca4441f6f42269d11e7136a1ee4329556b
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1108	1652	rundll32.exe	25
PID 1652 wrote to memory of 1108	1652	rundll32.exe	25
PID 1652 wrote to memory of 1108	1652	rundll32.exe	25
PID 1652 wrote to memory of 1108	1652	rundll32.exe	25
PID 1652 wrote to memory of 1108	1652	rundll32.exe	25
PID 1652 wrote to memory of 1108	1652	rundll32.exe	25
PID 1652 wrote to memory of 1108	1652	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85835671_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\85835671_by_Libranalysis.dll,#1
  2⤵
  PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-61-0x00000000754F1000-0x00000000754F3000-memory.dmp

Download