4fced48715bfb38deed045df8610229f3986090b64d28f56bcb501fe887ef584 | Triage™

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7v20210410
submitted
11/05/2021, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9411b6e_by_Libranalysis.dll
Size 162KB
Sample210511-ehtce58dqa
SHA256 4fced48715bfb38deed045df8610229f3986090b64d28f56bcb501fe887ef584
MD5 d9411b6e00047cfd99a4cb2fe544f434
SHA1 bfa5b860dc703b0917a7aa25681a88d5c45dcdae
SHA512 8564616f1f6ee8d19b8a0ce97b62f039b118318a328d834bc14ec877f62a3d31a544a7bcb516eab3295a6902c64d957a7152b31026dc1d8be1be28ede7d7df4d
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1932	1088	rundll32.exe	25
PID 1088 wrote to memory of 1932	1088	rundll32.exe	25
PID 1088 wrote to memory of 1932	1088	rundll32.exe	25
PID 1088 wrote to memory of 1932	1088	rundll32.exe	25
PID 1088 wrote to memory of 1932	1088	rundll32.exe	25
PID 1088 wrote to memory of 1932	1088	rundll32.exe	25
PID 1088 wrote to memory of 1932	1088	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9411b6e_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9411b6e_by_Libranalysis.dll,#1
  2⤵
  PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-61-0x0000000076E11000-0x0000000076E13000-memory.dmp

Download