419b2cbccbfd184f99a246a7e2c963748fac74da528a23760132f90c6e6fdc81 | Triage™

Analysis

max time kernel
25s
max time network
37s
platform
windows7_x64
resource
win7v20210408
submitted
21/05/2021, 05:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2bf3e38e_by_Libranalysis.dll
Size 162KB
Sample210521-eph43mnsps
SHA256 419b2cbccbfd184f99a246a7e2c963748fac74da528a23760132f90c6e6fdc81
MD5 2bf3e38ea01f7b4e35482c56d50b827a
SHA1 d9d956086e5fa067fd55995aaff2b27a3a31ad83
SHA512 546a043fe0c230f25b27f7b97e634c0660ba0d351867d627496746f3816cccf89926b97428d4044c4cca65a3a42816c3e177041457d18d3b543ec7f308dc04b8
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 848	1844	rundll32.exe	25
PID 1844 wrote to memory of 848	1844	rundll32.exe	25
PID 1844 wrote to memory of 848	1844	rundll32.exe	25
PID 1844 wrote to memory of 848	1844	rundll32.exe	25
PID 1844 wrote to memory of 848	1844	rundll32.exe	25
PID 1844 wrote to memory of 848	1844	rundll32.exe	25
PID 1844 wrote to memory of 848	1844	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bf3e38e_by_Libranalysis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bf3e38e_by_Libranalysis.dll,#1
  2⤵
  PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-61-0x0000000075D51000-0x0000000075D53000-memory.dmp

Download