3bdf5d01989e203e6edb9ee61fd310d79bd4c7163ca4b8aeef66f5ec035bee87 | Triage™

Analysis

max time kernel
127s
max time network
130s
platform
windows10_x64
resource
win10
submitted
23/07/2020, 17:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.jpg.dll
Size 388KB
Sample200723-pkht7a3ycx
SHA256 3bdf5d01989e203e6edb9ee61fd310d79bd4c7163ca4b8aeef66f5ec035bee87
MD5 954d4772495b611fe3d670f77fc97319
SHA1 93da6efc03652217b70d61c3ac772b6b6b2f6cbd
SHA512 975cf9c9c63daf3e26981b135329f72f7145b3bceb4c9f5298a9b795287760825aeecaece9419d90dc76cd9bb3634a8fe1c01f2f52d24c262c146c941ff4933d
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
336	rundll32.exe
336	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 336	720	rundll32.exe	67
PID 720 wrote to memory of 336	720	rundll32.exe	67
PID 720 wrote to memory of 336	720	rundll32.exe	67

Blacklisted process makes network request 6 IoCs

flow	pid	Process
6	336	rundll32.exe
7	336	rundll32.exe
9	336	rundll32.exe
11	336	rundll32.exe
13	336	rundll32.exe
15	336	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.jpg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.jpg.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Blacklisted process makes network request
  PID:336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads