dd2080084af2ebe00aaacf9dc0a7346cd66ba7121c662ae5f7520cf2d7c28bee | Triage™

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7v20210410
submitted
08/05/2021, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dad575f7_by_Libranalysis.dll
Size 162KB
Sample210508-tbrgrrtn7s
SHA256 dd2080084af2ebe00aaacf9dc0a7346cd66ba7121c662ae5f7520cf2d7c28bee
MD5 dad575f7d245ca56814963e2c86f3205
SHA1 09b469540459ca65406df57ca82bf9c24f1835d8
SHA512 7c2376623e3a2f74d675991451aa91e1a37deddaf0c38fc177b94c53f03fadccb8834ca34cfd21187d6bac70b632f41c7c38ad26d6a6c7bb0d84da0184e0233d
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2020	1268	rundll32.exe	26
PID 1268 wrote to memory of 2020	1268	rundll32.exe	26
PID 1268 wrote to memory of 2020	1268	rundll32.exe	26
PID 1268 wrote to memory of 2020	1268	rundll32.exe	26
PID 1268 wrote to memory of 2020	1268	rundll32.exe	26
PID 1268 wrote to memory of 2020	1268	rundll32.exe	26
PID 1268 wrote to memory of 2020	1268	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dad575f7_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dad575f7_by_Libranalysis.dll,#1
  2⤵
  PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-60-0x0000000075591000-0x0000000075593000-memory.dmp

Download