e98b07ca60ea27b79f08543d4c6ab61b47366a5f49898622f2ee90f7d12ada55 | Triage™

Analysis

max time kernel
75s
max time network
119s
platform
windows10_x64
resource
win10
submitted
13/08/2020, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
temp.tmp.dll
Size 168KB
Sample200813-51jbqpyeb6
SHA256 e98b07ca60ea27b79f08543d4c6ab61b47366a5f49898622f2ee90f7d12ada55
MD5 557516605fd7138df043ef3b950ae74b
SHA1 667dfdc1c789bf1a61ed42225e07f38eea1e78f0
SHA512 18369e24022568baf1d87f51073e68ea71731e9dfae515ab2f359a56cbd4c6815f3a333fbd5dcec7260a4e08c6d2bcd0fbc7eb0bb768e332c4383f99f4aa161e
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 11 IoCs

flow	pid	Process
6	3704	rundll32.exe
7	3704	rundll32.exe
9	3704	rundll32.exe
11	3704	rundll32.exe
13	3704	rundll32.exe
15	3704	rundll32.exe
17	3704	rundll32.exe
19	3704	rundll32.exe
21	3704	rundll32.exe
26	3704	rundll32.exe
28	3704	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3704	rundll32.exe
3704	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 3704	3612	rundll32.exe	67
PID 3612 wrote to memory of 3704	3612	rundll32.exe	67
PID 3612 wrote to memory of 3704	3612	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp.tmp.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads