00b24762f3358c6e4e91cae4f2832ca8c00b47cccd6af0a886c66c09dbe4e3dc | Triage™

Analysis

max time kernel
150s
max time network
150s
platform
windows10_x64
resource
win10
submitted
21/07/2020, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Graftor.770268.7060.19249.dll
Size 224KB
Sample200721-b9rr1mbv7j
SHA256 00b24762f3358c6e4e91cae4f2832ca8c00b47cccd6af0a886c66c09dbe4e3dc
MD5 47ce88149479fc7fe2123b4b100ebc4b
SHA1 a4463c9507110d3cf3e25c81ef580e89054828e9
SHA512 d275ee641abe68efdaa8c5698c73030c45a55cdbe0f357d99931787b900f3c2e89e545bd43b417c7d42e646c20be063b36438c3808247789a60ce83927e7e164
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3968	3100	rundll32.exe	67
PID 3100 wrote to memory of 3968	3100	rundll32.exe	67
PID 3100 wrote to memory of 3968	3100	rundll32.exe	67

Blacklisted process makes network request 14 IoCs

flow	pid	Process
16	3968	rundll32.exe
17	3968	rundll32.exe
19	3968	rundll32.exe
21	3968	rundll32.exe
23	3968	rundll32.exe
25	3968	rundll32.exe
27	3968	rundll32.exe
29	3968	rundll32.exe
31	3968	rundll32.exe
33	3968	rundll32.exe
36	3968	rundll32.exe
38	3968	rundll32.exe
41	3968	rundll32.exe
43	3968	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Graftor.770268.7060.19249.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Graftor.770268.7060.19249.dll,#1
  2⤵
  - Blacklisted process makes network request
  PID:3968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads