91a8d66f5c1f651e0f60c456fa8dd06347f69be8ba5542f9c6781e6714962fa9 | Triage

Analysis

max time kernel
17s
max time network
114s
platform
windows10_x64
resource
win10v20210408
submitted
30-07-2021 09:06

Sharing

Report Analysis Logs

General

Target

KG_Crypt_API.dll
Size

53KB
MD5

c8b5751886fb1fbfd182e225ae01aca7
SHA1

a7a88a4eb732dd4f71c938ba27e015e4438fed1e
SHA256

886e3dcda7fdfa1ece28894d87f45c0a0ed73bdd5d8ca31c741e90a74dd818b6
SHA512

c6fd4b54c66ca5faf5b242802fdaacff50e1cd74117a8238d15e2cd04987339aad4a8c3ee5418f0da8f05a046fc20fccdda5a8943d0e9cdc35732692e97285f3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 516 wrote to memory of 1388	516	rundll32.exe	rundll32.exe
PID 516 wrote to memory of 1388	516	rundll32.exe	rundll32.exe
PID 516 wrote to memory of 1388	516	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KG_Crypt_API.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:516

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KG_Crypt_API.dll,#1
2⤵
PID:1388

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-114-0x0000000000000000-mapping.dmp

Download