bf81fbbc09954cde0f6883a4f983b8f9623a9e126a242dacf7afeafcd156679d | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-en-20211208
submitted
16-12-2021 16:12

Sharing

Report Analysis Logs

General

Target

storelibir-2.dll
Size

276KB
MD5

a0656d35a382b58c75cb9fb3f5388f35
SHA1

f4da2119c184a5fbf2d7233bd3d7352fecfb50e2
SHA256

1fb68c58d9764fc0327de464152274044cb5664e6a3d3881ca1ce562e7fe59f3
SHA512

d0509c71073d1f55b5c5c485e2743f5ce8ff0042524d80d8e6e5cddea4ed4e59ad199963d5548b99d9eb646bd9d1abe45fb0d0add63ba0e427ceec2ac34bcb25

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1212 wrote to memory of 1860	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1860	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1860	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1860	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1860	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1860	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1860	1212	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\storelibir-2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\storelibir-2.dll,#1
2⤵
PID:1860

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-54-0x0000000000000000-mapping.dmp

Download
memory/1860-55-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download