e418bfc1be89802f12b8ed50f898aeffac961ec222368e5b4d100d90119b7011 | Triage

Analysis

max time kernel
5s
max time network
12s
platform
windows7_x64
resource
win7v20210410
submitted
15-05-2021 15:38

Sharing

Report Analysis Logs

General

Target

e418bfc1be89802f12b8ed50f898aeffac961ec222368e5b4d100d90119b7011.dll
Size

128KB
MD5

fda322ef2931a061dae8acab91792068
SHA1

643b3a021e18c8d1e1c3ea1744b3cd463e21ab89
SHA256

e418bfc1be89802f12b8ed50f898aeffac961ec222368e5b4d100d90119b7011
SHA512

2828b52398e9018e23b7777b9494ce1a0b24c7895c92801be213e6b6fcf84d907a6211dd8481e66cd10a9590844299b1a79f77825801d5f328d4b4dd051a89b4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 452 wrote to memory of 2000	452	rundll32.exe	rundll32.exe
PID 452 wrote to memory of 2000	452	rundll32.exe	rundll32.exe
PID 452 wrote to memory of 2000	452	rundll32.exe	rundll32.exe
PID 452 wrote to memory of 2000	452	rundll32.exe	rundll32.exe
PID 452 wrote to memory of 2000	452	rundll32.exe	rundll32.exe
PID 452 wrote to memory of 2000	452	rundll32.exe	rundll32.exe
PID 452 wrote to memory of 2000	452	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e418bfc1be89802f12b8ed50f898aeffac961ec222368e5b4d100d90119b7011.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:452

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e418bfc1be89802f12b8ed50f898aeffac961ec222368e5b4d100d90119b7011.dll,#1
2⤵
PID:2000

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-60-0x0000000000000000-mapping.dmp

Download
memory/2000-61-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download