acd7214a4c37bbfd55ea244080769e4c0daf59edb47b3abcddcf5874cdb3054f | Triage™

Analysis

max time kernel
53s
max time network
57s
platform
windows7_x64
resource
win7
submitted
24/06/2020, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x86_1_43652012_Agreement.dll
Size 281KB
Sample200624-msvrmtntks
SHA256 acd7214a4c37bbfd55ea244080769e4c0daf59edb47b3abcddcf5874cdb3054f
MD5 a8653b87fa1d4f73da86fd962e9c4b95
SHA1 b17b32b567f1a600338f61b27f316f893aad195d
SHA512 a899e9a43c4abe66a119612a6bb4e8261b5b0917bff73e206971c32e7db625cd5e01de833aced231fc8581d5a3f8a98b994f0ec31095d49a98232fad769418c0
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1228	1100	rundll32.exe	24
PID 1100 wrote to memory of 1228	1100	rundll32.exe	24
PID 1100 wrote to memory of 1228	1100	rundll32.exe	24
PID 1100 wrote to memory of 1228	1100	rundll32.exe	24
PID 1100 wrote to memory of 1228	1100	rundll32.exe	24
PID 1100 wrote to memory of 1228	1100	rundll32.exe	24
PID 1100 wrote to memory of 1228	1100	rundll32.exe	24

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1228	rundll32.exe

Blacklisted process makes network request 1 IoCs

flow	pid	Process
2	1228	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86_1_43652012_Agreement.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86_1_43652012_Agreement.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Blacklisted process makes network request
  PID:1228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads