0d6870a3d1b27ae23c9e2c413fb2b367b69323ead81bf38524a54cc17e8a809b | Triage

Analysis

max time kernel
4294178s
max time network
135s
platform
windows7_x64
resource
win7-20220311-en
submitted
13-04-2022 00:45

Sharing

Report Analysis Logs

General

Target

mfc140u.dll
Size

4.9MB
MD5

d6c87b75c8641349d2ce1fcd0757b6d4
SHA1

fc4a354d08f7b2bc8f86f577d495d2c5c7760905
SHA256

69e0f71e6ed1a17ecbe67e93ecf2a65c55a87ba1cbbbb258ada33dbc2977ec9d
SHA512

947752c2b171097c1f5c1e63aa043464673e8738289e342e43916a66c4401b38faff8a5efb753623be09f50911c0b7976dfb0289845efb0a0b3151ed88e357d5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 576 wrote to memory of 320	576	rundll32.exe	rundll32.exe
PID 576 wrote to memory of 320	576	rundll32.exe	rundll32.exe
PID 576 wrote to memory of 320	576	rundll32.exe	rundll32.exe
PID 576 wrote to memory of 320	576	rundll32.exe	rundll32.exe
PID 576 wrote to memory of 320	576	rundll32.exe	rundll32.exe
PID 576 wrote to memory of 320	576	rundll32.exe	rundll32.exe
PID 576 wrote to memory of 320	576	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mfc140u.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mfc140u.dll,#1
2⤵
PID:320

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-54-0x0000000000000000-mapping.dmp

Download
memory/320-55-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download