03b9c7a3b73f15dfc2dcb0b74f3e971fdda7d1d1e2010c6d1861043f90a2fecd

General
Target

03b9c7a3b73f15dfc2dcb0b74f3e971fdda7d1d1e2010c6d1861043f90a2fecd.dll

Filesize

201KB

Completed

26-09-2021 13:11

Score
1 /10
MD5

0a49ed1c5419bb9752821d856f7ce4ff

SHA1

e026e1f27d503a23aaab354c1de6e17d4c6a2b1f

SHA256

03b9c7a3b73f15dfc2dcb0b74f3e971fdda7d1d1e2010c6d1861043f90a2fecd

Malware Config
Signatures 2

Filter: none

  • Suspicious behavior: EnumeratesProcesses
    rundll32.exe

    Reported IOCs

    pidprocess
    624rundll32.exe
    624rundll32.exe
  • Suspicious use of WriteProcessMemory
    rundll32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 532 wrote to memory of 624532rundll32.exerundll32.exe
    PID 532 wrote to memory of 624532rundll32.exerundll32.exe
    PID 532 wrote to memory of 624532rundll32.exerundll32.exe
Processes 2
  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\03b9c7a3b73f15dfc2dcb0b74f3e971fdda7d1d1e2010c6d1861043f90a2fecd.dll,#1
    Suspicious use of WriteProcessMemory
    PID:532
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\03b9c7a3b73f15dfc2dcb0b74f3e971fdda7d1d1e2010c6d1861043f90a2fecd.dll,#1
      Suspicious behavior: EnumeratesProcesses
      PID:624
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/624-114-0x0000000000000000-mapping.dmp

                          • memory/624-115-0x0000000000400000-0x0000000000434000-memory.dmp