d9b40c2b268ff23981ec939f0b1d8e395df51e0545e1ada4fd1cc16b60c574b6 | Triage™

Analysis

max time kernel
114s
max time network
121s
platform
windows7_x64
resource
win7
submitted
24/07/2020, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TT.pdf.dll
Size 280KB
Sample200724-2q69gr6d46
SHA256 d9b40c2b268ff23981ec939f0b1d8e395df51e0545e1ada4fd1cc16b60c574b6
MD5 ec792ea3c651e81fd66010f85a7b9502
SHA1 86762ec26ffd55a0ec4924e7a916c5774f0cc076
SHA512 8b961ddc6283745a0c680e617987426d3ff74bd549c51159b24a85a248527398ea879593cf8a9796737d0a69268328bd5bf2638ca037b625996bea7c4829e955
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1068	1156	rundll32.exe	24
PID 1156 wrote to memory of 1068	1156	rundll32.exe	24
PID 1156 wrote to memory of 1068	1156	rundll32.exe	24
PID 1156 wrote to memory of 1068	1156	rundll32.exe	24
PID 1156 wrote to memory of 1068	1156	rundll32.exe	24
PID 1156 wrote to memory of 1068	1156	rundll32.exe	24
PID 1156 wrote to memory of 1068	1156	rundll32.exe	24

Blacklisted process makes network request 8 IoCs

flow	pid	Process
3	1068	rundll32.exe
5	1068	rundll32.exe
6	1068	rundll32.exe
8	1068	rundll32.exe
9	1068	rundll32.exe
13	1068	rundll32.exe
15	1068	rundll32.exe
17	1068	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1068	rundll32.exe
1068	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TT.pdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TT.pdf.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads