3fa22573e71c3c461a84acc5c469b5ec5955d317e506c854e7d2d1faea7868ea | Triage™

Analysis

max time kernel
130s
max time network
71s
platform
windows10_x64
resource
win10v200430
submitted
15/07/2020, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2020-07-14-DLL-for-IcedID-installer-example-14-of-18.bin.dll
Size 159KB
Sample200715-4dk7yk12h2
SHA256 3fa22573e71c3c461a84acc5c469b5ec5955d317e506c854e7d2d1faea7868ea
MD5 24d47cc0b22d24615f0b46fc54cfe085
SHA1 597b52553df96a24c5041795f891d458da0d138b
SHA512 0167b5ec8f0363ef02917573123bdd77bd61f959860438198940e7d33e162a68f4a543f1aae3b640dcc0286eb9eb5263ab78d4e6b70528a39767eed4e3e73875
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 952	4072	rundll32.exe	68
PID 4072 wrote to memory of 952	4072	rundll32.exe	68
PID 4072 wrote to memory of 952	4072	rundll32.exe	68

Blacklisted process makes network request 4 IoCs

flow	pid	Process
9	952	rundll32.exe
11	952	rundll32.exe
13	952	rundll32.exe
15	952	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
952	rundll32.exe
952	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2020-07-14-DLL-for-IcedID-installer-example-14-of-18.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2020-07-14-DLL-for-IcedID-installer-example-14-of-18.bin.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads