9ec75fe69dd6dd37d717db0ba784ba0e9a2ca6d2fa8a4b485952d90ae64a8222 | Triage

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2023, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

remcos_dump1.dll
Size

1.6MB
MD5

e41a38863f830ac71c9522735b950fb5
SHA1

f7141b7542e4852a8c8f840b475e1482df2b3fbd
SHA256

9ec75fe69dd6dd37d717db0ba784ba0e9a2ca6d2fa8a4b485952d90ae64a8222
SHA512

dbb67fb2cc73f389af69a3a72c6ae32d73279ba1605cde7bb9d595a268e9a7807cd7ac06c536f4ac36476f6f371e5e0e282e5133049cacc1cd71463299d97417
SSDEEP

24576:BnS/mDzRIfYTRW1jhpvhIXcX6958T2o7XmuUKWSe+K3qOX8c:jDbT2vmMXKu2o7WubFc8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 4016	2844	rundll32.exe	84
PID 2844 wrote to memory of 4016	2844	rundll32.exe	84
PID 2844 wrote to memory of 4016	2844	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\remcos_dump1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\remcos_dump1.dll,#1
  2⤵
  PID:4016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads