705e14735da74b107357a676c15b07c0f0c86888b8f98ba86e1029ff4e4858df | Triage™

Analysis

max time kernel
90s
max time network
112s
platform
windows10_x64
resource
win10
submitted
21/09/2020, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e325b.pdf.dll
Size 406KB
Sample200921-rx3b2b1lej
SHA256 705e14735da74b107357a676c15b07c0f0c86888b8f98ba86e1029ff4e4858df
MD5 5d7ce2398942eb03bd0065aea3d5da15
SHA1 8c1977305284f6ef719d6e92f0e90f069476a62a
SHA512 a014ab056f924d3a037df8bbdd59cc8e3f95a25c5c6fed04a5a90aa848aca5af2700b4ae1367d9a92efe7eb82265c8c5ecf5e24ba251bc752c68ba49bece9fa6
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 8 IoCs

flow	pid	Process
12	3852	rundll32.exe
15	3852	rundll32.exe
17	3852	rundll32.exe
19	3852	rundll32.exe
21	3852	rundll32.exe
23	3852	rundll32.exe
25	3852	rundll32.exe
27	3852	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3852	rundll32.exe
3852	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 3852	3844	rundll32.exe	67
PID 3844 wrote to memory of 3852	3844	rundll32.exe	67
PID 3844 wrote to memory of 3852	3844	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e325b.pdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e325b.pdf.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads