f471dd00f4b6a468217499ea6c8db72b3c9fb26c1e16fcb6f50ef90f0ba13dfa | Triage™

Analysis

max time kernel
23s
max time network
14s
platform
windows7_x64
resource
win7v20210410
submitted
12/05/2021, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e7500aff_by_Libranalysis.dll
Size 162KB
Sample210512-eaa82y89f6
SHA256 f471dd00f4b6a468217499ea6c8db72b3c9fb26c1e16fcb6f50ef90f0ba13dfa
MD5 e7500aff95386532e51165c451974fb5
SHA1 dae113f6ccebcb82863bf760854f5f89b51431fd
SHA512 a630cf644884cbbf95cd9dffec7a85a011832b58847c40908e2360459d6619da773a6b87ad77b64a70df95485315a3ffb0c170f47cf0a4f94ed4850a3c6fde5e
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2008	1080	rundll32.exe	25
PID 1080 wrote to memory of 2008	1080	rundll32.exe	25
PID 1080 wrote to memory of 2008	1080	rundll32.exe	25
PID 1080 wrote to memory of 2008	1080	rundll32.exe	25
PID 1080 wrote to memory of 2008	1080	rundll32.exe	25
PID 1080 wrote to memory of 2008	1080	rundll32.exe	25
PID 1080 wrote to memory of 2008	1080	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7500aff_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7500aff_by_Libranalysis.dll,#1
  2⤵
  PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-61-0x00000000757D1000-0x00000000757D3000-memory.dmp

Download