d211906acb73763b59025aefe321109bade1d8f9d315627eea1c2a32df19c3a7 | Triage™

Analysis

max time kernel
140s
max time network
81s
platform
windows10_x64
resource
win10v200722
submitted
10/08/2020, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
preview.jpeg.dll
Size 242KB
Sample200810-73g5twejsn
SHA256 d211906acb73763b59025aefe321109bade1d8f9d315627eea1c2a32df19c3a7
MD5 fa84a2999a4568d7a1a0e8a486359850
SHA1 2324cefc772cbc3972de6b4572eea188c0c70400
SHA512 0b53bf7b4c0585ebede1727a03ca27206319e150c9ae254786df189abdbc68f8e0f3cccb26dc4b828951396234a7a4cc6b74c6e0207508d121c94b0724070144
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 9 IoCs

flow	pid	Process
12	2928	rundll32.exe
16	2928	rundll32.exe
18	2928	rundll32.exe
20	2928	rundll32.exe
22	2928	rundll32.exe
24	2928	rundll32.exe
26	2928	rundll32.exe
28	2928	rundll32.exe
30	2928	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2928	rundll32.exe
2928	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 2928	3984	rundll32.exe	66
PID 3984 wrote to memory of 2928	3984	rundll32.exe	66
PID 3984 wrote to memory of 2928	3984	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\preview.jpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\preview.jpeg.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads