a00dd572aecd2c1fb8755b09cf33d85beecae09c804019409ca37742e55e8c3f | Triage™

Analysis

max time kernel
86s
max time network
87s
platform
windows10_x64
resource
win10v200722
submitted
24/07/2020, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
111.jpg.dll
Size 280KB
Sample200724-vpqhez5w4e
SHA256 a00dd572aecd2c1fb8755b09cf33d85beecae09c804019409ca37742e55e8c3f
MD5 ec456678d737606541c3166d441e86c3
SHA1 cbed2a2f17fe5f80277f33f33acad97257268476
SHA512 1a3f373373ce87f1ee0042afcd7f90839f5bc236c952787cf471acda9d6847eb090dcd3f82edd57be727f9fdf6dc3f56e5e33565f3ef6e755f7525987811e18e
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 10 IoCs

flow	pid	Process
7	840	rundll32.exe
13	840	rundll32.exe
14	840	rundll32.exe
16	840	rundll32.exe
18	840	rundll32.exe
20	840	rundll32.exe
22	840	rundll32.exe
24	840	rundll32.exe
26	840	rundll32.exe
29	840	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
840	rundll32.exe
840	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 840	636	rundll32.exe	67
PID 636 wrote to memory of 840	636	rundll32.exe	67
PID 636 wrote to memory of 840	636	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\111.jpg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\111.jpg.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads