2ca554a264d85b3e0c84bbfe31c8f34a96fedccb37b3398d1f85b0d85a1b2a9c | Triage™

Analysis

max time kernel
122s
max time network
124s
platform
windows10_x64
resource
win10
submitted
23/07/2020, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.jpg.dll
Size 388KB
Sample200723-2t541cenvx
SHA256 2ca554a264d85b3e0c84bbfe31c8f34a96fedccb37b3398d1f85b0d85a1b2a9c
MD5 0553ba4a61ec72cfe68277f9903d7a20
SHA1 46529154ef59cee908c71992bee9be1609903215
SHA512 09ca27c4260cb222c69d6db6dd62e99fb7d1615a1430c7df90e6b2e01683740b9d8dde445296e3118fa3a98f502f73a3ec88347e50085b36b85785939a19846a
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 3852	976	rundll32.exe	67
PID 976 wrote to memory of 3852	976	rundll32.exe	67
PID 976 wrote to memory of 3852	976	rundll32.exe	67

Blacklisted process makes network request 6 IoCs

flow	pid	Process
5	3852	rundll32.exe
6	3852	rundll32.exe
8	3852	rundll32.exe
10	3852	rundll32.exe
14	3852	rundll32.exe
16	3852	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3852	rundll32.exe
3852	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.jpg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.jpg.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads