da4e1bb6c651a569ee44eb2d2a37eaae7035a46d8281592b77666f0819fcf1c8 | Triage™

Analysis

max time kernel
116s
max time network
115s
platform
windows10_x64
resource
win10
submitted
30/07/2020, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.tmp.dll
Size 172KB
Sample200730-n5jw9anzla
SHA256 da4e1bb6c651a569ee44eb2d2a37eaae7035a46d8281592b77666f0819fcf1c8
MD5 59775e072d82190977677987d08e73d2
SHA1 d76e9a3911d69ee6cdb2490f3c4b89c59df034c1
SHA512 5871ecbd5d5ff3d6aca97c145171075de27f8ef1d83d0a6e144b1cd4e0d2beed7c1e1a8e6f958882c3c15d35c37d2a100ade8fc21c99c75f0abcf56812326f57
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 3672	3588	rundll32.exe	67
PID 3588 wrote to memory of 3672	3588	rundll32.exe	67
PID 3588 wrote to memory of 3672	3588	rundll32.exe	67

Blacklisted process makes network request 12 IoCs

flow	pid	Process
5	3672	rundll32.exe
7	3672	rundll32.exe
9	3672	rundll32.exe
11	3672	rundll32.exe
13	3672	rundll32.exe
15	3672	rundll32.exe
16	3672	rundll32.exe
18	3672	rundll32.exe
20	3672	rundll32.exe
22	3672	rundll32.exe
24	3672	rundll32.exe
27	3672	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3672	rundll32.exe
3672	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.tmp.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads