3869de46f081e1373e68f81564b9bb4684f56844aa7dc59fa5a8f2d8eddeef9a | Triage™

Analysis

max time kernel
79s
max time network
113s
platform
windows10_x64
resource
win10v200722
submitted
07/10/2020, 21:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nvZDu.pdf.dll
Size 287KB
Sample201007-eev62y27cs
SHA256 3869de46f081e1373e68f81564b9bb4684f56844aa7dc59fa5a8f2d8eddeef9a
MD5 d6c2060c805a6a20ca991b5b52d9361f
SHA1 0dac6a4d5d1336a020d58ccb5d64b2e6dea61cae
SHA512 d87dcb13877d089a6b2b2e59564062c72953c366fd3a782318c02fb69d2839eb0d2654ff4dc419c6475d085b9913ce5e62af8d7184698feecbb4859e490012f5
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 5 IoCs

flow	pid	Process
16	384	rundll32.exe
18	384	rundll32.exe
20	384	rundll32.exe
22	384	rundll32.exe
24	384	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
384	rundll32.exe
384	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 384	788	rundll32.exe	68
PID 788 wrote to memory of 384	788	rundll32.exe	68
PID 788 wrote to memory of 384	788	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nvZDu.pdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\nvZDu.pdf.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads