33ad2ead4123fc853e403d35c1dcf7c75eb634ef5a195f572f1ad76ad6f9bf5e | Triage

Analysis

max time kernel
124s
max time network
130s
platform
windows7_x64
resource
win7v200430
submitted
17-07-2020 14:38

Sharing

Report Analysis Logs

General

Target

jpg.exe.dll
Size

256KB
MD5

ada15bb76f1ad60d7a706c7a39482d91
SHA1

14ad55fea359159b88638415631e556aa9866fa5
SHA256

33ad2ead4123fc853e403d35c1dcf7c75eb634ef5a195f572f1ad76ad6f9bf5e
SHA512

80c8bb99028aea5e2b1828b495194bf1b94020f47f25849c9cb69a9245265bd68aeea46fc357d4b7df30ca832307766bcc9bdbea9e8dd54511f67b01e184434a

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 892 wrote to memory of 600	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 600	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 600	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 600	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 600	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 600	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 600	892	rundll32.exe	rundll32.exe

Blacklisted process makes network request 8 IoCs

Processes:

rundll32.exe

flow pid process

5 600 rundll32.exe
6 600 rundll32.exe
8 600 rundll32.exe
9 600 rundll32.exe
11 600 rundll32.exe
13 600 rundll32.exe
15 600 rundll32.exe
17 600 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jpg.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jpg.exe.dll,#1
2⤵
- Blacklisted process makes network request
PID:600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/600-0-0x0000000000000000-mapping.dmp

Download