e80810241a2c6991cd3cfc807a62c1392eeed146fc60cb30326a8e3bc6bc284e | Triage

Analysis

max time kernel
5s
max time network
56s
platform
windows7_x64
resource
win7v20210410
submitted
26-07-2021 12:42

Sharing

Report Analysis Logs

General

Target

e80810241a2c6991cd3cfc807a62c1392eeed146fc60cb30326a8e3bc6bc284e.sample.dll
Size

166KB
MD5

a2fe81e5b83c0d1ea321429446870e18
SHA1

b1fc2a1e8e1739ecf9fe2e0b7b20618321eea765
SHA256

e80810241a2c6991cd3cfc807a62c1392eeed146fc60cb30326a8e3bc6bc284e
SHA512

b0a250932cebbcfed89564a67c6b5385b9a65e089810bd071b1be721af7fee55af8ec31fd7b415295b6bbd1b2f1ef564c4a8c3c7b40101d1e90e5fb0cd7905c9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1676 wrote to memory of 1868	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 1868	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 1868	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 1868	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 1868	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 1868	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 1868	1676	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e80810241a2c6991cd3cfc807a62c1392eeed146fc60cb30326a8e3bc6bc284e.sample.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e80810241a2c6991cd3cfc807a62c1392eeed146fc60cb30326a8e3bc6bc284e.sample.dll,#1
2⤵
PID:1868

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1868-59-0x0000000000000000-mapping.dmp

Download
memory/1868-60-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download