0d6870a3d1b27ae23c9e2c413fb2b367b69323ead81bf38524a54cc17e8a809b | Triage

Analysis

max time kernel
114s
max time network
48s
platform
windows7_x64
resource
win7-20220331-en
submitted
13-04-2022 00:45

Sharing

Report Analysis Logs

General

Target

mfcm140.dll
Size

90KB
MD5

8e030107ad8e7614e3fc2f7b6b3ae3d6
SHA1

eb10c41c9e1cf6085a6d6e2901a38382193be0b1
SHA256

2abfd142bf578b90f3938337dd9986ab339e30d0ca60c4a2fee4cfb2299b2ad8
SHA512

f8f22894e0503cb604a5eeb9fec68174c6784cebb7ff5141c843aabef1ed8124b0b789e993d6275737bd6d609e7855597bfc72c59d4f1f38297226e49fbd9820

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 940 wrote to memory of 2016	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 2016	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 2016	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 2016	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 2016	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 2016	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 2016	940	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mfcm140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mfcm140.dll,#1
2⤵
PID:2016

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-54-0x0000000000000000-mapping.dmp

Download
memory/2016-55-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download