3c5e2a4afe58634f45c48f4e800dc56bae3907dde308ff97740e9cd5684d1c53 | Triage

Analysis

max time kernel
10s
max time network
113s
platform
windows10_x64
resource
win10v20210410
submitted
27-07-2021 22:10

Sharing

Report Analysis Logs

General

Target

3c5e2a4afe58634f45c48f4e800dc56bae3907dde308ff97740e9cd5684d1c53.bin.dll
Size

74KB
MD5

03b78817cbff3cbd8688011c09f6dd1e
SHA1

37b26787786368cd51a356032a2a7f6d86810a8c
SHA256

3c5e2a4afe58634f45c48f4e800dc56bae3907dde308ff97740e9cd5684d1c53
SHA512

7375837a5edacd80e646cfaca483bd32130c2907f0cc1fb4046b36adafb9fa8015df0163d4c9e22c1e82f8f80ad0b79d9e1820d821c9f9fe6b3b4ee120166827

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4092 wrote to memory of 3224	4092	rundll32.exe	rundll32.exe
PID 4092 wrote to memory of 3224	4092	rundll32.exe	rundll32.exe
PID 4092 wrote to memory of 3224	4092	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c5e2a4afe58634f45c48f4e800dc56bae3907dde308ff97740e9cd5684d1c53.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c5e2a4afe58634f45c48f4e800dc56bae3907dde308ff97740e9cd5684d1c53.bin.dll,#1
2⤵
PID:3224

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3224-114-0x0000000000000000-mapping.dmp

Download