15537c9176d7e6d5c28c607c4b147c8c2a7c45102b1b8e836b38d2f9449fc8ce | Triage

Analysis

max time kernel
16s
max time network
151s
platform
windows10_x64
resource
win10v20210408
submitted
21-07-2021 20:55

Sharing

Report Analysis Logs

General

Target

SDL.dll
Size

314KB
MD5

fd7e7a20a9cb5cca5dbb81ea3d207de1
SHA1

15fb67a5ba30a63257d5875a609652433de1ac27
SHA256

15537c9176d7e6d5c28c607c4b147c8c2a7c45102b1b8e836b38d2f9449fc8ce
SHA512

e3c5b9d07064991a0dbfea2d6b8a17212f79816bd398ca823af6550db5c1f70ae68d7c9d08074fd34a44aba3e1e5acc1613704112bcc4d37486eb527dbfcc665

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 644 wrote to memory of 1192	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 1192	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 1192	644	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SDL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SDL.dll,#1
2⤵
PID:1192

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-114-0x0000000000000000-mapping.dmp

Download