6c55126eb5ebfbf3bcdac310a44fe3debeabec192689e4706a377f0fcbb26d97 | Triage™

Analysis

max time kernel
121s
max time network
173s
platform
windows7_x64
resource
win7v20210410
submitted
19/08/2021, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1ad0ef26e95163677b3dc9cc45a707c1.dll
Size 616KB
Sample210819-xkpsppmbda
SHA256 6c55126eb5ebfbf3bcdac310a44fe3debeabec192689e4706a377f0fcbb26d97
MD5 1ad0ef26e95163677b3dc9cc45a707c1
SHA1 44e2c6dad6f69fa0bbb67be2e8d14232d396de91
SHA512 d7b0ff7a5c0797abf4151bdca83904de20634df06e2feb573cfcb53b580e4fcd2101766e679206dae33784cf2687c36fc0f53c7d941c23114a3af4e0e8ffd042
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2016	1032	rundll32.exe	25
PID 1032 wrote to memory of 2016	1032	rundll32.exe	25
PID 1032 wrote to memory of 2016	1032	rundll32.exe	25
PID 1032 wrote to memory of 2016	1032	rundll32.exe	25
PID 1032 wrote to memory of 2016	1032	rundll32.exe	25
PID 1032 wrote to memory of 2016	1032	rundll32.exe	25
PID 1032 wrote to memory of 2016	1032	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ad0ef26e95163677b3dc9cc45a707c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ad0ef26e95163677b3dc9cc45a707c1.dll,#1
  2⤵
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-61-0x0000000075591000-0x0000000075593000-memory.dmp

Download