6196a0966d3fbe5726736f0fd7661a0a928fdce345cb377e79cea039594a79f0 | Triage™

Resubmissions

06/01/2024, 23:25

240106-3ep6hsabhj10

24/07/2020, 17:12

200724-he6fb8dnc68

Analysis

max time kernel
113s
max time network
120s
platform
windows7_x64
resource
win7
submitted
24/07/2020, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
111.jpg.dll
Size 363KB
Sample200724-he6fb8dnc6
SHA256 6196a0966d3fbe5726736f0fd7661a0a928fdce345cb377e79cea039594a79f0
MD5 4896a4b3071b13c65fefc4842464843b
SHA1 583b57b0c60a640c908fbf37f1b50fcfab57a96d
SHA512 a24eba4bfaf1c41387ba66b21ba9ddd16d2cf9b3b333fb7c11391ec517d38a4c553bf936232c8d263c4af47caba4b3d439e1864859dad55bcebce9f43b78fc19
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1512	1440	rundll32.exe	24
PID 1440 wrote to memory of 1512	1440	rundll32.exe	24
PID 1440 wrote to memory of 1512	1440	rundll32.exe	24
PID 1440 wrote to memory of 1512	1440	rundll32.exe	24
PID 1440 wrote to memory of 1512	1440	rundll32.exe	24
PID 1440 wrote to memory of 1512	1440	rundll32.exe	24
PID 1440 wrote to memory of 1512	1440	rundll32.exe	24

Blacklisted process makes network request 8 IoCs

flow	pid	Process
3	1512	rundll32.exe
7	1512	rundll32.exe
8	1512	rundll32.exe
10	1512	rundll32.exe
11	1512	rundll32.exe
13	1512	rundll32.exe
15	1512	rundll32.exe
17	1512	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1512	rundll32.exe
1512	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\111.jpg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\111.jpg.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads