33a254d82ed46fb2c38d0ae52dbefb012fb3b9e61e7cd8ebb5f0163e4a635a3e | Triage™

Analysis

max time kernel
109s
max time network
132s
platform
windows10_x64
resource
win10v200430
submitted
15/07/2020, 16:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59e55f3cadc5e9b2755b1a27936f2836.dll
Size 141KB
Sample200715-6k5nyh3hlj
SHA256 33a254d82ed46fb2c38d0ae52dbefb012fb3b9e61e7cd8ebb5f0163e4a635a3e
MD5 59e55f3cadc5e9b2755b1a27936f2836
SHA1 a91f9eff5b15f25be0d2048d5c1773efe59d8c14
SHA512 af1c5c0e98be67f7691587f43ddea0f822a21777b0739854b0c423e1b6ddbbffed7eae50d94490d3cd829a869a78ab69207a6c449155c0485f729b2f20f71354
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2452	2104	rundll32.exe	68
PID 2104 wrote to memory of 2452	2104	rundll32.exe	68
PID 2104 wrote to memory of 2452	2104	rundll32.exe	68

Blacklisted process makes network request 4 IoCs

flow	pid	Process
6	2452	rundll32.exe
8	2452	rundll32.exe
10	2452	rundll32.exe
12	2452	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2452	rundll32.exe
2452	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e55f3cadc5e9b2755b1a27936f2836.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e55f3cadc5e9b2755b1a27936f2836.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads