56982ec00725aef61b81dd101f82ee4e1c5aa4e7750c79cc20d184af198b22fd | Triage™

Analysis

max time kernel
84s
max time network
86s
platform
windows10_x64
resource
win10v200722
submitted
18/08/2020, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
temp.tmp.dll
Size 79KB
Sample200818-mj3da4h766
SHA256 56982ec00725aef61b81dd101f82ee4e1c5aa4e7750c79cc20d184af198b22fd
MD5 284b5de23d81009b9282b82ab44f1e7e
SHA1 82cf2a503fb0e5fcafbdd7c976c0727f6df253f6
SHA512 9301586f202cc98f5fb2f79eefb916697eb9518fb5b4654663996a2551bcb0a18095f48bd3bb7d1db967184b33e44df61c44386931915674868bf100e1576c33
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 9 IoCs

flow	pid	Process
2	836	rundll32.exe
4	836	rundll32.exe
6	836	rundll32.exe
8	836	rundll32.exe
10	836	rundll32.exe
17	836	rundll32.exe
23	836	rundll32.exe
25	836	rundll32.exe
27	836	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
836	rundll32.exe
836	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 836	788	rundll32.exe	67
PID 788 wrote to memory of 836	788	rundll32.exe	67
PID 788 wrote to memory of 836	788	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp.tmp.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads