Analysis
-
max time kernel
124s -
max time network
130s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
17-07-2020 14:38
Static task
static1
Behavioral task
behavioral1
Sample
jpg.exe.dll
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
jpg.exe.dll
Resource
win10
0 signatures
0 seconds
General
-
Target
jpg.exe.dll
-
Size
256KB
-
MD5
ada15bb76f1ad60d7a706c7a39482d91
-
SHA1
14ad55fea359159b88638415631e556aa9866fa5
-
SHA256
33ad2ead4123fc853e403d35c1dcf7c75eb634ef5a195f572f1ad76ad6f9bf5e
-
SHA512
80c8bb99028aea5e2b1828b495194bf1b94020f47f25849c9cb69a9245265bd68aeea46fc357d4b7df30ca832307766bcc9bdbea9e8dd54511f67b01e184434a
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 892 wrote to memory of 600 892 rundll32.exe rundll32.exe PID 892 wrote to memory of 600 892 rundll32.exe rundll32.exe PID 892 wrote to memory of 600 892 rundll32.exe rundll32.exe PID 892 wrote to memory of 600 892 rundll32.exe rundll32.exe PID 892 wrote to memory of 600 892 rundll32.exe rundll32.exe PID 892 wrote to memory of 600 892 rundll32.exe rundll32.exe PID 892 wrote to memory of 600 892 rundll32.exe rundll32.exe -
Blacklisted process makes network request 8 IoCs
Processes:
rundll32.exeflow pid process 5 600 rundll32.exe 6 600 rundll32.exe 8 600 rundll32.exe 9 600 rundll32.exe 11 600 rundll32.exe 13 600 rundll32.exe 15 600 rundll32.exe 17 600 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jpg.exe.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jpg.exe.dll,#12⤵
- Blacklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/600-0-0x0000000000000000-mapping.dmp