d9b40c2b268ff23981ec939f0b1d8e395df51e0545e1ada4fd1cc16b60c574b6 | Triage™

Analysis

max time kernel
85s
max time network
87s
platform
windows10_x64
resource
win10v200722
submitted
24/07/2020, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TT.pdf.dll
Size 280KB
Sample200724-2q69gr6d46
SHA256 d9b40c2b268ff23981ec939f0b1d8e395df51e0545e1ada4fd1cc16b60c574b6
MD5 ec792ea3c651e81fd66010f85a7b9502
SHA1 86762ec26ffd55a0ec4924e7a916c5774f0cc076
SHA512 8b961ddc6283745a0c680e617987426d3ff74bd549c51159b24a85a248527398ea879593cf8a9796737d0a69268328bd5bf2638ca037b625996bea7c4829e955
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3960	rundll32.exe
3960	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 3960	2096	rundll32.exe	66
PID 2096 wrote to memory of 3960	2096	rundll32.exe	66
PID 2096 wrote to memory of 3960	2096	rundll32.exe	66

Blacklisted process makes network request 10 IoCs

flow	pid	Process
10	3960	rundll32.exe
13	3960	rundll32.exe
14	3960	rundll32.exe
16	3960	rundll32.exe
18	3960	rundll32.exe
20	3960	rundll32.exe
22	3960	rundll32.exe
24	3960	rundll32.exe
26	3960	rundll32.exe
28	3960	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TT.pdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TT.pdf.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Blacklisted process makes network request
  PID:3960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads