a24c9c11820e4a66b72eb6e512469a85a3cc0dbea8c838cd4bfe210ce75f047a | Triage

Analysis

max time kernel
4s
max time network
26s
platform
windows7_x64
resource
win7v20210408
submitted
13-05-2021 12:56

Sharing

Report Analysis Logs

General

Target

a24c9c11820e4a66b72eb6e512469a85a3cc0dbea8c838cd4bfe210ce75f047a.dll
Size

98KB
MD5

f7927c5216c8680a24728154f9de6fe1
SHA1

295fdcb73839877570e3d79a2f5113c2d8ba0b1b
SHA256

a24c9c11820e4a66b72eb6e512469a85a3cc0dbea8c838cd4bfe210ce75f047a
SHA512

5cc5e7472b183700e4206d3ca46937541ece66148cde1eed0153e8043396945359f116e6efbd36975d7b6767b1722f6891d5ed1107f1a4f134b4088424b41699

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2000 wrote to memory of 1964	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1964	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1964	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1964	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1964	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1964	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1964	2000	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a24c9c11820e4a66b72eb6e512469a85a3cc0dbea8c838cd4bfe210ce75f047a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a24c9c11820e4a66b72eb6e512469a85a3cc0dbea8c838cd4bfe210ce75f047a.dll,#1
2⤵
PID:1964

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-60-0x0000000000000000-mapping.dmp

Download
memory/1964-61-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download
memory/1964-62-0x0000000000160000-0x0000000000172000-memory.dmp

Filesize
72KB

Download