94349d76ec1a0c4f60d8d6b59e5dd0883a533a17c9a7c7a87cab5d4540e5d4ea | Triage™

Analysis

max time kernel
75s
max time network
78s
platform
windows10_x64
resource
win10v200722
submitted
13/08/2020, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
preview.jpg.dll
Size 168KB
Sample200813-qem661d5k2
SHA256 94349d76ec1a0c4f60d8d6b59e5dd0883a533a17c9a7c7a87cab5d4540e5d4ea
MD5 f1824a2c99c949e4878f5d00bb7c9b56
SHA1 e054b2d8fa69c20895c1dc9280932a01b8bcc5ed
SHA512 ce16c47e909b1848426ebd31e74402b7ce957074106a8f6207a4747ca8d31efb46f48f439c08145e100f9e553eaa30876cbdabcea2dc28fe1034c51e3119d440
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 11 IoCs

flow	pid	Process
7	2904	rundll32.exe
8	2904	rundll32.exe
10	2904	rundll32.exe
14	2904	rundll32.exe
19	2904	rundll32.exe
21	2904	rundll32.exe
23	2904	rundll32.exe
25	2904	rundll32.exe
27	2904	rundll32.exe
29	2904	rundll32.exe
31	2904	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2904	rundll32.exe
2904	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 2904	3608	rundll32.exe	66
PID 3608 wrote to memory of 2904	3608	rundll32.exe	66
PID 3608 wrote to memory of 2904	3608	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\preview.jpg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\preview.jpg.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads