abeb9bec19b733006fd8d163f51ce46cbe8b05d5e7d3b78ae6408d245ea02d96 | Triage™

Analysis

max time kernel
92s
max time network
112s
platform
windows10_x64
resource
win10v200722
submitted
09/10/2020, 21:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HnHaD.pdf.dll
Size 220KB
Sample201009-8a4hy27kms
SHA256 abeb9bec19b733006fd8d163f51ce46cbe8b05d5e7d3b78ae6408d245ea02d96
MD5 1d9d0c1c60114bb81305cfc0f48f1a98
SHA1 cd1c02f3eafa2417ea9c646f13fa48421f20d83f
SHA512 0025ed8cd92d302ca1c2ab18731fdc067ebd5d6071d8d32058aa389ce13914b794f76f36eb92f9628d6181c55ab77f83d3c6b2e4803460d4a864319482370a9e
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 11 IoCs

flow	pid	Process
16	396	rundll32.exe
18	396	rundll32.exe
20	396	rundll32.exe
22	396	rundll32.exe
24	396	rundll32.exe
26	396	rundll32.exe
28	396	rundll32.exe
30	396	rundll32.exe
32	396	rundll32.exe
34	396	rundll32.exe
36	396	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
396	rundll32.exe
396	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 396	512	rundll32.exe	68
PID 512 wrote to memory of 396	512	rundll32.exe	68
PID 512 wrote to memory of 396	512	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HnHaD.pdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HnHaD.pdf.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads