Analysis
-
max time kernel
12s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
18-05-2021 11:24
Static task
static1
Behavioral task
behavioral1
Sample
1fc468447ef829e6c8b41e8bc047609158283913c8aff39f21fd92184c306553.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
1fc468447ef829e6c8b41e8bc047609158283913c8aff39f21fd92184c306553.dll
-
Size
951KB
-
MD5
b8b0cd32c9c415c56b2d19d6a51c2970
-
SHA1
7acf95bb4d998eeec61c2536068dfa932f881e2d
-
SHA256
1fc468447ef829e6c8b41e8bc047609158283913c8aff39f21fd92184c306553
-
SHA512
ec10dd6aef88d39e27995c1618f6709b46ca56313d6f78ebed92ab860c0f006782c552d0c10a3d2de87b32b50aef630545934b4a32da261355fe10ccb42333dc
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4072 wrote to memory of 668 4072 rundll32.exe rundll32.exe PID 4072 wrote to memory of 668 4072 rundll32.exe rundll32.exe PID 4072 wrote to memory of 668 4072 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1fc468447ef829e6c8b41e8bc047609158283913c8aff39f21fd92184c306553.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1fc468447ef829e6c8b41e8bc047609158283913c8aff39f21fd92184c306553.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/668-114-0x0000000000000000-mapping.dmp