f092b985b75a702c784f0936ce892595b91d025b26f3387a712b76dcc3a4bc81 | Triage

Analysis

max time kernel
115s
max time network
118s
platform
windows10_x64
resource
win10-en-20210920
submitted
26-09-2021 13:18

Sharing

Report Analysis Logs

General

Target

f092b985b75a702c784f0936ce892595b91d025b26f3387a712b76dcc3a4bc81.dll
Size

199KB
MD5

23a6691939ae3e33b3c31ada6eeed7b8
SHA1

deae30bdc505699a61f65d4e629e5b66adf57034
SHA256

f092b985b75a702c784f0936ce892595b91d025b26f3387a712b76dcc3a4bc81
SHA512

0ac04fcb67530d2ce3ea0f5380bab82682d1c42b988503de0063d4c418834eb694846b38cb95c65218aa8e46372564d55948c745f1b7a5c8c9d03c078bb106bd

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1864 rundll32.exe
1864 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1796 wrote to memory of 1864	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1864	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1864	1796	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f092b985b75a702c784f0936ce892595b91d025b26f3387a712b76dcc3a4bc81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f092b985b75a702c784f0936ce892595b91d025b26f3387a712b76dcc3a4bc81.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1864

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-115-0x0000000000000000-mapping.dmp

Download
memory/1864-116-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download