Analysis
-
max time kernel
14s -
max time network
126s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
10-07-2021 10:36
Behavioral task
behavioral1
Sample
e44443912307f69f276ad248e42b0d982e1f45101250818817fad4d0ab66dd5a.bin.sample.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e44443912307f69f276ad248e42b0d982e1f45101250818817fad4d0ab66dd5a.bin.sample.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
e44443912307f69f276ad248e42b0d982e1f45101250818817fad4d0ab66dd5a.bin.sample.dll
-
Size
8.2MB
-
MD5
28ac1727f7d0ff4e3faaadffb9e78433
-
SHA1
c52427998ff35a96cdc51a68ccd11d6e021f8477
-
SHA256
e44443912307f69f276ad248e42b0d982e1f45101250818817fad4d0ab66dd5a
-
SHA512
c49be86132f908ddadf420f4e2010174dbd09a4e2cff145e98f01b09eb91710c445cfa443fd1876df8a91c932e52cf0bf96a2817b34cd3108b3eef8f615a42bb
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3724 wrote to memory of 3696 3724 rundll32.exe rundll32.exe PID 3724 wrote to memory of 3696 3724 rundll32.exe rundll32.exe PID 3724 wrote to memory of 3696 3724 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e44443912307f69f276ad248e42b0d982e1f45101250818817fad4d0ab66dd5a.bin.sample.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e44443912307f69f276ad248e42b0d982e1f45101250818817fad4d0ab66dd5a.bin.sample.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3696-114-0x0000000000000000-mapping.dmp