b60fdb0e79aed9d05d5cfc84eb8548eff1e81d311caeedba7d1a39807ff54ec5 | Triage™

Analysis

max time kernel
24s
max time network
9s
platform
windows7_x64
resource
win7v20210410
submitted
12/05/2021, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e4b613ae_by_Libranalysis.dll
Size 162KB
Sample210512-e19yl78hg2
SHA256 b60fdb0e79aed9d05d5cfc84eb8548eff1e81d311caeedba7d1a39807ff54ec5
MD5 e4b613ae3734743adbff6b165e550c18
SHA1 09ea4e7f01bdbd70cdcc6aa84ecc84de8215b658
SHA512 33278baa1883d33fefdd0b3a98fd10435dbe11b0a2b8b308d0cf09a4b688eff54cd1797d48e91e3266949fab7441b54727e3b1d6412c71e29fc5d5ad409fb838
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1988	1072	rundll32.exe	25
PID 1072 wrote to memory of 1988	1072	rundll32.exe	25
PID 1072 wrote to memory of 1988	1072	rundll32.exe	25
PID 1072 wrote to memory of 1988	1072	rundll32.exe	25
PID 1072 wrote to memory of 1988	1072	rundll32.exe	25
PID 1072 wrote to memory of 1988	1072	rundll32.exe	25
PID 1072 wrote to memory of 1988	1072	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4b613ae_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e4b613ae_by_Libranalysis.dll,#1
  2⤵
  PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-61-0x0000000075411000-0x0000000075413000-memory.dmp

Download