10541da23f1a6299fe00f9657b9dad7dae53c3091f39f1cfec03f30a93286168 | Triage™

Analysis

max time kernel
67s
max time network
117s
platform
windows10_x64
resource
win10
submitted
30/07/2020, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.tmp.dll
Size 172KB
Sample200730-ef67jywy1e
SHA256 10541da23f1a6299fe00f9657b9dad7dae53c3091f39f1cfec03f30a93286168
MD5 35dc6864f8832b2228e0d6b972795010
SHA1 07203219cb29b166929ade88b7e24357dc53009c
SHA512 10401dddef6187ff73f92044b56edb40b27608144d4ed657a3459335b5eab65ce81cdfc76c376106f2bd7bf2b38d1ac4faf6040bbf88e6c7e82c09b20a4fc426
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 3904	3920	rundll32.exe	67
PID 3920 wrote to memory of 3904	3920	rundll32.exe	67
PID 3920 wrote to memory of 3904	3920	rundll32.exe	67

Blacklisted process makes network request 12 IoCs

flow	pid	Process
5	3904	rundll32.exe
7	3904	rundll32.exe
9	3904	rundll32.exe
11	3904	rundll32.exe
13	3904	rundll32.exe
15	3904	rundll32.exe
16	3904	rundll32.exe
18	3904	rundll32.exe
20	3904	rundll32.exe
22	3904	rundll32.exe
25	3904	rundll32.exe
27	3904	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3904	rundll32.exe
3904	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.tmp.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads