dddc57299857e6ecb2b80cbab2ae6f1978e89c4bfe664c7607129b0fc8db8b1f | Triage™

Analysis

max time kernel
121s
max time network
138s
platform
windows10_x64
resource
win10-en-20211014
submitted
03/11/2021, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dddc57299857e6ecb2b80cbab2ae6f1978e89c4bfe664c7607129b0fc8db8b1f.dll
Size 1.2MB
Sample211103-pgmaradga6
SHA256 dddc57299857e6ecb2b80cbab2ae6f1978e89c4bfe664c7607129b0fc8db8b1f
MD5 2c143271dc4e8da1d3f94bb15df49ab3
SHA1 f437544e14ac6389806fdee8a4ea335b3d7dfe2f
SHA512 83f5126a1cf9fe91f11b2a4ca2c173830dd331f47009348ec27481d2c4c2d8f49e1a96b05f2b03e343c977f7ab7508afaf42d5b637decda8adbcb9b28814716d
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3748	3040	rundll32.exe	68
PID 3040 wrote to memory of 3748	3040	rundll32.exe	68
PID 3040 wrote to memory of 3748	3040	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dddc57299857e6ecb2b80cbab2ae6f1978e89c4bfe664c7607129b0fc8db8b1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dddc57299857e6ecb2b80cbab2ae6f1978e89c4bfe664c7607129b0fc8db8b1f.dll,#1
  2⤵
  PID:3748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads