6fede71248803463757ea05e875e0cdb97d38245c0d28597639aa797a90987ce | Triage

Analysis

max time kernel
127s
max time network
150s
platform
windows10_x64
resource
win10v200430
submitted
15-07-2020 08:21

Sharing

Report Analysis Logs

General

Target

2020-07-14-DLL-for-IcedID-installer-example-15-of-18.bin.dll
Size

159KB
MD5

5535e7340a1760af3dbc01fcc8f52378
SHA1

906c62992f0d44715ca940c6a08f0be5696d89f4
SHA256

6fede71248803463757ea05e875e0cdb97d38245c0d28597639aa797a90987ce
SHA512

09f33fca95748ed62716332a2e9dfc441d35fde39e7c2c956fcec16f37e26f1781b808d7a8b84c27b3091585acb238538b082f9bd992a413868dcf5280326661

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 1176	3216	rundll32.exe	68
PID 3216 wrote to memory of 1176	3216	rundll32.exe	68
PID 3216 wrote to memory of 1176	3216	rundll32.exe	68

Blacklisted process makes network request 4 IoCs

flow	pid	Process
7	1176	rundll32.exe
9	1176	rundll32.exe
11	1176	rundll32.exe
13	1176	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1176	rundll32.exe
1176	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2020-07-14-DLL-for-IcedID-installer-example-15-of-18.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2020-07-14-DLL-for-IcedID-installer-example-15-of-18.bin.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads