e10fa45aa8fff5891a60afb5f15c2a8b3827b425b59656a0dc114cb7dd8d419f | Triage

Analysis

max time kernel
35s
max time network
135s
platform
windows10_x64
resource
win10v20210408
submitted
14-07-2021 13:22

Sharing

Report Analysis Logs

General

Target

574e9f8074520690b36e5169a331263b .dll
Size

497KB
MD5

574e9f8074520690b36e5169a331263b
SHA1

cd2e237fbb2e183acc02528288edd34ca777b8c6
SHA256

e10fa45aa8fff5891a60afb5f15c2a8b3827b425b59656a0dc114cb7dd8d419f
SHA512

cfd1f9ad19a271022eb2e53e3100a15ee7fc931721aaed3fc532715e7041aa703f8d75b36e9d0d0750d7832112dd61cc129e63f0b2b0009880935a3b3daefdfe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 808 wrote to memory of 1364	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 1364	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 1364	808	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ 574e9f8074520690b36e5169a331263b .dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ 574e9f8074520690b36e5169a331263b .dll",#1
2⤵
PID:1364

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-114-0x0000000000000000-mapping.dmp

Download
memory/1364-115-0x0000000000B20000-0x0000000000BAE000-memory.dmp

Filesize
568KB

Download
memory/1364-116-0x0000000000BF0000-0x0000000000C30000-memory.dmp

Filesize
256KB

Download