0a3bc15ceb80f700d80b7d651ff378cf407c239f3e513e3bc9bd854f82f7e22c | Triage™

Analysis

max time kernel
46s
max time network
136s
platform
windows10_x64
resource
win10v20210408
submitted
23/08/2021, 11:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61238cfcc2441.dll
Size 544KB
Sample210823-2mk5ahabbn
SHA256 0a3bc15ceb80f700d80b7d651ff378cf407c239f3e513e3bc9bd854f82f7e22c
MD5 454908e620c33ca3e631a6334e8b1ff1
SHA1 50f292391060ff4d772a4fd695f9eba8432a8fd8
SHA512 0e3165221a8f751c2e54e40d5ffa2012b43535f19bf89a0d6b7f7ec287546e1312c6c43759bd2cc97ad4bc0e9fcc622dbc42b5c7a7f17f2794f1101607de6ca7
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 1584	648	rundll32.exe	70
PID 648 wrote to memory of 1584	648	rundll32.exe	70
PID 648 wrote to memory of 1584	648	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61238cfcc2441.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61238cfcc2441.dll,#1
  2⤵
  PID:1584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1584-115-0x00000000047C0000-0x00000000047E3000-memory.dmp

Download