49cb8b4834caefbd754777b332e40c302ae8e99017cf6d3e20fb49733dcb2774 | Triage™

Analysis

max time kernel
145s
max time network
122s
platform
windows10_x64
resource
win10v200722
submitted
13/08/2020, 20:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
preview.jpg.dll
Size 168KB
Sample200813-brd5eerlya
SHA256 49cb8b4834caefbd754777b332e40c302ae8e99017cf6d3e20fb49733dcb2774
MD5 4fc30b0e079c974122b677796f55ff00
SHA1 5c29418a5f1b00486e4f36054ed657a7c3b8e32f
SHA512 5f82e5e9a6b67319c2d8f6643899c51ce740353b4ba3055319ba8992e255d925b95b4376112fb2abc92c13a1d55d780630a41c5866183e4229b35b9f7e9759e5
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 11 IoCs

flow	pid	Process
16	1876	rundll32.exe
17	1876	rundll32.exe
19	1876	rundll32.exe
21	1876	rundll32.exe
25	1876	rundll32.exe
27	1876	rundll32.exe
29	1876	rundll32.exe
31	1876	rundll32.exe
33	1876	rundll32.exe
35	1876	rundll32.exe
37	1876	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1876	rundll32.exe
1876	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 1876	3956	rundll32.exe	66
PID 3956 wrote to memory of 1876	3956	rundll32.exe	66
PID 3956 wrote to memory of 1876	3956	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\preview.jpg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\preview.jpg.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads