725e252b9a759587bffe569832c002108b57127dbdc4ed7bddfec04c6a2e1d41 | Triage™

Analysis

max time kernel
136s
max time network
137s
platform
windows10_x64
resource
win10v200722
submitted
25/08/2020, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
something.exe.dll
Size 581KB
Sample200825-mr845fcnls
SHA256 725e252b9a759587bffe569832c002108b57127dbdc4ed7bddfec04c6a2e1d41
MD5 a99bfc7d32428b271a8b0025942af53c
SHA1 9f2ba32fd939fc2ad92b282310e5aefae3718db9
SHA512 2a28b9588db47fb6bd8f56aba6ba484153e08bc6711bcd40593fe65698cfcf7591f0e1a17f8182d90ea850f8e9b7f6f34ca45d9014c886b11e1068a686d7b665
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	580	3960	rundll32.exe	66

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1568	rundll32.exe
1568	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\something.exe.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1568

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
1⤵
- Process spawned unexpected child process
PID:580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads