0d6870a3d1b27ae23c9e2c413fb2b367b69323ead81bf38524a54cc17e8a809b | Triage

Analysis

max time kernel
4294181s
max time network
147s
platform
windows7_x64
resource
win7-20220311-en
submitted
13-04-2022 00:45

Sharing

Report Analysis Logs

General

Target

mfcm140u.dll
Size

90KB
MD5

71f8b79bf46a2348e5de572a1b66de66
SHA1

7b1d349f8a3273a45c1343e336ee7d89ff13dfe8
SHA256

42216cd1644a2cd6146b79a48cd68ead88c71413f860218d7b38da8b5db59626
SHA512

bc19c7ca2903c5308eb4f9456b641e0f3fa8f0a4715ba4b22fc10e87f8ba201a00e6925634b0af276ec2cf1cbab671e9d07ace49d3330dfb0e8e94c2e4681b1b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1120 wrote to memory of 1472	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 1472	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 1472	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 1472	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 1472	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 1472	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 1472	1120	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mfcm140u.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mfcm140u.dll,#1
2⤵
PID:1472

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-54-0x0000000000000000-mapping.dmp

Download
memory/1472-55-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download