35823106288275adb9d1bd4bc25f08d8c1b8803540b8d8b2040b8098a1450ace | Triage

Analysis

max time kernel
5s
max time network
11s
platform
windows7_x64
resource
win7v20210410
submitted
10-07-2021 10:35

Sharing

Report Analysis Logs

General

Target

35823106288275adb9d1bd4bc25f08d8c1b8803540b8d8b2040b8098a1450ace.bin.sample.dll
Size

8.1MB
MD5

d312c332180ca2fbc961dbe7557690de
SHA1

115a5a6c3b8e40d3abca0e99dd355141ef7a35ba
SHA256

35823106288275adb9d1bd4bc25f08d8c1b8803540b8d8b2040b8098a1450ace
SHA512

29dfa09bd920638bb0eeb977dc80f6e975c1192d984b41a13ce1c297685d8881a7c2958ff3884612ca72a4c5fc1457093b7724d27414ad905f008c77f17eb4ab

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1072 wrote to memory of 828	1072	rundll32.exe	rundll32.exe
PID 1072 wrote to memory of 828	1072	rundll32.exe	rundll32.exe
PID 1072 wrote to memory of 828	1072	rundll32.exe	rundll32.exe
PID 1072 wrote to memory of 828	1072	rundll32.exe	rundll32.exe
PID 1072 wrote to memory of 828	1072	rundll32.exe	rundll32.exe
PID 1072 wrote to memory of 828	1072	rundll32.exe	rundll32.exe
PID 1072 wrote to memory of 828	1072	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35823106288275adb9d1bd4bc25f08d8c1b8803540b8d8b2040b8098a1450ace.bin.sample.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35823106288275adb9d1bd4bc25f08d8c1b8803540b8d8b2040b8098a1450ace.bin.sample.dll,#1
2⤵
PID:828

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-60-0x0000000000000000-mapping.dmp

Download
memory/828-61-0x0000000075411000-0x0000000075413000-memory.dmp

Filesize
8KB

Download