6196a0966d3fbe5726736f0fd7661a0a928fdce345cb377e79cea039594a79f0 | Triage™

Resubmissions

06/01/2024, 23:25

240106-3ep6hsabhj10

24/07/2020, 17:12

200724-he6fb8dnc68

Analysis

max time kernel
144s
max time network
84s
platform
windows10_x64
resource
win10v200722
submitted
24/07/2020, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
111.jpg.dll
Size 363KB
Sample200724-he6fb8dnc6
SHA256 6196a0966d3fbe5726736f0fd7661a0a928fdce345cb377e79cea039594a79f0
MD5 4896a4b3071b13c65fefc4842464843b
SHA1 583b57b0c60a640c908fbf37f1b50fcfab57a96d
SHA512 a24eba4bfaf1c41387ba66b21ba9ddd16d2cf9b3b333fb7c11391ec517d38a4c553bf936232c8d263c4af47caba4b3d439e1864859dad55bcebce9f43b78fc19
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 508	3876	rundll32.exe	66
PID 3876 wrote to memory of 508	3876	rundll32.exe	66
PID 3876 wrote to memory of 508	3876	rundll32.exe	66

Blacklisted process makes network request 10 IoCs

flow	pid	Process
14	508	rundll32.exe
16	508	rundll32.exe
17	508	rundll32.exe
19	508	rundll32.exe
21	508	rundll32.exe
23	508	rundll32.exe
25	508	rundll32.exe
27	508	rundll32.exe
29	508	rundll32.exe
31	508	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
508	rundll32.exe
508	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\111.jpg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\111.jpg.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads