acd7214a4c37bbfd55ea244080769e4c0daf59edb47b3abcddcf5874cdb3054f | Triage™

Analysis

max time kernel
110s
max time network
131s
platform
windows10_x64
resource
win10v200430
submitted
24/06/2020, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x86_1_43652012_Agreement.dll
Size 281KB
Sample200624-msvrmtntks
SHA256 acd7214a4c37bbfd55ea244080769e4c0daf59edb47b3abcddcf5874cdb3054f
MD5 a8653b87fa1d4f73da86fd962e9c4b95
SHA1 b17b32b567f1a600338f61b27f316f893aad195d
SHA512 a899e9a43c4abe66a119612a6bb4e8261b5b0917bff73e206971c32e7db625cd5e01de833aced231fc8581d5a3f8a98b994f0ec31095d49a98232fad769418c0
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2144	2416	rundll32.exe	68
PID 2416 wrote to memory of 2144	2416	rundll32.exe	68
PID 2416 wrote to memory of 2144	2416	rundll32.exe	68

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2144	rundll32.exe
2144	rundll32.exe

Blacklisted process makes network request 1 IoCs

flow	pid	Process
4	2144	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86_1_43652012_Agreement.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86_1_43652012_Agreement.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Blacklisted process makes network request
  PID:2144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads