62ea4a0e0ad8fa3b025a5eb6a6ef0e74972ee8f4ca55be901d4badbf6d60d6e8 | Triage™

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-en-20211104
submitted
01/12/2021, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cfd3cca091137b88f3eac109796ebaaa.dll
Size 267KB
Sample211201-rf5f2scgcr
SHA256 62ea4a0e0ad8fa3b025a5eb6a6ef0e74972ee8f4ca55be901d4badbf6d60d6e8
MD5 cfd3cca091137b88f3eac109796ebaaa
SHA1 8ed3c5fa47bbae34c0bd92939f20b1f868f156c7
SHA512 13251c623920e23a2df90c2595cccc01ec041962893719e5d11d454a459d3e56d4fb5bcdf2d4ab19e857f99b0204b23610d7d6bb86e01393656f52c8780b3695
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1512	1584	rundll32.exe	27
PID 1584 wrote to memory of 1512	1584	rundll32.exe	27
PID 1584 wrote to memory of 1512	1584	rundll32.exe	27
PID 1584 wrote to memory of 1512	1584	rundll32.exe	27
PID 1584 wrote to memory of 1512	1584	rundll32.exe	27
PID 1584 wrote to memory of 1512	1584	rundll32.exe	27
PID 1584 wrote to memory of 1512	1584	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfd3cca091137b88f3eac109796ebaaa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfd3cca091137b88f3eac109796ebaaa.dll,#1
  2⤵
  PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-56-0x0000000075801000-0x0000000075803000-memory.dmp

Download