e20625c960a91ec091691275bb549b73c154bd4f8fa4305ed414a28e321e4aaf | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-en-20211208
submitted
24-01-2022 00:50

Sharing

Report Analysis Logs

General

Target

e20625c960a91ec091691275bb549b73c154bd4f8fa4305ed414a28e321e4aaf.dll
Size

164KB
MD5

9c65d2fd6624be4b0d3804aacf80956a
SHA1

296052d476b8857eaa5529d4a6cbc8a0ed73bc3b
SHA256

e20625c960a91ec091691275bb549b73c154bd4f8fa4305ed414a28e321e4aaf
SHA512

a87632bd316d25e868a9a3ab37b794436cae52e1764c631655aa8f15cbd764e6fe39741fd6828122873fcbde294cb7697d387aae1950913789a1541f8e7ad494

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1564 wrote to memory of 808	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 808	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 808	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 808	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 808	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 808	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 808	1564	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e20625c960a91ec091691275bb549b73c154bd4f8fa4305ed414a28e321e4aaf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e20625c960a91ec091691275bb549b73c154bd4f8fa4305ed414a28e321e4aaf.dll,#1
2⤵
PID:808

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download