72140cd87c7b181794aaf13e8b01f1896c7dfdcd76292bbe11ff950a1630b036 | Triage™

Analysis

max time kernel
122s
max time network
124s
platform
windows10_x64
resource
win10
submitted
17/07/2020, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d8ee94bb77c15c5a4a9537670a211cf7.dll
Size 256KB
Sample200717-34aaaq1ky2
SHA256 72140cd87c7b181794aaf13e8b01f1896c7dfdcd76292bbe11ff950a1630b036
MD5 d8ee94bb77c15c5a4a9537670a211cf7
SHA1 24ab97c72db0570cace75e5b4b873c933ccff619
SHA512 30d0912d23a8068ce87e8a77fe876ccb120e85c6e0ceaa35b0cf0f8c06eb63cf2e0b415acd4be807b0ae4a7cd310f04cb9e705c0cc03f8554dbc0ef95d632863
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 3848	3684	rundll32.exe	67
PID 3684 wrote to memory of 3848	3684	rundll32.exe	67
PID 3684 wrote to memory of 3848	3684	rundll32.exe	67

Blacklisted process makes network request 11 IoCs

flow	pid	Process
9	3848	rundll32.exe
10	3848	rundll32.exe
12	3848	rundll32.exe
14	3848	rundll32.exe
16	3848	rundll32.exe
18	3848	rundll32.exe
20	3848	rundll32.exe
22	3848	rundll32.exe
24	3848	rundll32.exe
26	3848	rundll32.exe
28	3848	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3848	rundll32.exe
3848	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8ee94bb77c15c5a4a9537670a211cf7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8ee94bb77c15c5a4a9537670a211cf7.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads