8acca08a2375c6e143aa203ccd4e16f8b13f3cd54254c3eb4c272aeac43f555f | Triage™

Analysis

max time kernel
93s
max time network
95s
platform
windows10_x64
resource
win10v200722
submitted
23/07/2020, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.jpg.dll
Size 388KB
Sample200723-q3xf69dynn
SHA256 8acca08a2375c6e143aa203ccd4e16f8b13f3cd54254c3eb4c272aeac43f555f
MD5 a27173011620a4538c236d9cced53c9f
SHA1 94bdbe20fac497353253d2e5fee7f8bbd933ba92
SHA512 4aa5ec2271bcf0aa3f6e8838ec957d9a14dd89cebaf713d5dafaa683cd03389c8628ecf732a17f8cd5205ad7058aa96f28d033b132d493ca1125a49aa5f0274c
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2076	3816	rundll32.exe	66
PID 3816 wrote to memory of 2076	3816	rundll32.exe	66
PID 3816 wrote to memory of 2076	3816	rundll32.exe	66

Blacklisted process makes network request 5 IoCs

flow	pid	Process
11	2076	rundll32.exe
12	2076	rundll32.exe
14	2076	rundll32.exe
16	2076	rundll32.exe
20	2076	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2076	rundll32.exe
2076	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.jpg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.jpg.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads