07fe977241ab3c72ac5653b08767c0aa6f8e37d89f292a9fcc5b30a4e407e68c | Triage™

Analysis

max time kernel
144s
max time network
118s
platform
windows10_x64
resource
win10v200722
submitted
24/07/2020, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kfa1.bin.dll
Size 280KB
Sample200724-l9k96q7pc2
SHA256 07fe977241ab3c72ac5653b08767c0aa6f8e37d89f292a9fcc5b30a4e407e68c
MD5 01b4e685d3d83b15b784131e73393e0f
SHA1 eb45e4ba2e885bf1c7fcc73103d1254b9f16cea1
SHA512 4464112423ba195259e3b796e72200fdba4e87e672d8f7c4f9d266b4b51576c30f0dd9f1231de67ba1538fd994bcdfe261df7a330a7ccfbb5ee8c453c7bd960d
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 508	3876	rundll32.exe	66
PID 3876 wrote to memory of 508	3876	rundll32.exe	66
PID 3876 wrote to memory of 508	3876	rundll32.exe	66

Blacklisted process makes network request 10 IoCs

flow	pid	Process
11	508	rundll32.exe
15	508	rundll32.exe
16	508	rundll32.exe
18	508	rundll32.exe
20	508	rundll32.exe
22	508	rundll32.exe
24	508	rundll32.exe
26	508	rundll32.exe
28	508	rundll32.exe
30	508	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
508	rundll32.exe
508	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\kfa1.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\kfa1.bin.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads