9fbef301703a0ed03cfd6c61a5522eb14ff9c834d97a53bf2b1eef5b54471763 | Triage™

Analysis

max time kernel
68s
max time network
70s
platform
windows10_x64
resource
win10v200722
submitted
18/08/2020, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
temp.tmp.dll
Size 79KB
Sample200818-5lltetspge
SHA256 9fbef301703a0ed03cfd6c61a5522eb14ff9c834d97a53bf2b1eef5b54471763
MD5 f015194e23fad8e8ba37bf3e4fdc1852
SHA1 333bb7beae3d7ca5f7e474eec2acf496028c2f78
SHA512 ac6512ce55fe9e690a5df78f945c9cb4406b8a46646459095dbc26ecf5856f77c8e26f3ab5e2a9156ae4ad27fa63cbf1fed8d4a3886d76be971b5393dfc816f6
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 9 IoCs

flow	pid	Process
13	628	rundll32.exe
15	628	rundll32.exe
17	628	rundll32.exe
19	628	rundll32.exe
21	628	rundll32.exe
23	628	rundll32.exe
25	628	rundll32.exe
27	628	rundll32.exe
29	628	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
628	rundll32.exe
628	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 628	532	rundll32.exe	66
PID 532 wrote to memory of 628	532	rundll32.exe	66
PID 532 wrote to memory of 628	532	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp.tmp.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads