eca49a13a5cbb36865e2d31adeb1344c6cd4fa72f01e46499f0f7a086bd4db38 | Triage™

Analysis

max time kernel
98s
max time network
125s
platform
windows10_x64
resource
win10
submitted
18/08/2020, 19:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
temp1.tmp.dll
Size 208KB
Sample200818-1e271rtvcs
SHA256 eca49a13a5cbb36865e2d31adeb1344c6cd4fa72f01e46499f0f7a086bd4db38
MD5 dc49b7dad722ea1f7fddb6919dd35312
SHA1 62c30a4c043aab88578779157e983c7892998ed3
SHA512 a740b4cceaf2b3aa1453edd204f3f646d2854ecd13ba7b83bfd2f55380969d4becf4f476a101764eb131c204a19c25ad34349e5e0ebb5d136b66a5bd1d4839b2
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 12 IoCs

flow	pid	Process
5	3112	rundll32.exe
7	3112	rundll32.exe
9	3112	rundll32.exe
11	3112	rundll32.exe
13	3112	rundll32.exe
15	3112	rundll32.exe
17	3112	rundll32.exe
20	3112	rundll32.exe
21	3112	rundll32.exe
23	3112	rundll32.exe
31	3112	rundll32.exe
33	3112	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3112	rundll32.exe
3112	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 3112	2288	rundll32.exe	67
PID 2288 wrote to memory of 3112	2288	rundll32.exe	67
PID 2288 wrote to memory of 3112	2288	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp1.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp1.tmp.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads