35823106288275adb9d1bd4bc25f08d8c1b8803540b8d8b2040b8098a1450ace | Triage

Analysis

max time kernel
12s
max time network
113s
platform
windows10_x64
resource
win10v20210410
submitted
10-07-2021 10:35

Sharing

Report Analysis Logs

General

Target

35823106288275adb9d1bd4bc25f08d8c1b8803540b8d8b2040b8098a1450ace.bin.sample.dll
Size

8.1MB
MD5

d312c332180ca2fbc961dbe7557690de
SHA1

115a5a6c3b8e40d3abca0e99dd355141ef7a35ba
SHA256

35823106288275adb9d1bd4bc25f08d8c1b8803540b8d8b2040b8098a1450ace
SHA512

29dfa09bd920638bb0eeb977dc80f6e975c1192d984b41a13ce1c297685d8881a7c2958ff3884612ca72a4c5fc1457093b7724d27414ad905f008c77f17eb4ab

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1496 wrote to memory of 3832	1496	rundll32.exe	rundll32.exe
PID 1496 wrote to memory of 3832	1496	rundll32.exe	rundll32.exe
PID 1496 wrote to memory of 3832	1496	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35823106288275adb9d1bd4bc25f08d8c1b8803540b8d8b2040b8098a1450ace.bin.sample.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35823106288275adb9d1bd4bc25f08d8c1b8803540b8d8b2040b8098a1450ace.bin.sample.dll,#1
2⤵
PID:3832

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3832-114-0x0000000000000000-mapping.dmp

Download