83d5ceb21e632bda8a75388aad568444c414f2e06e96e73863bdccbefc48d17a | Triage™

Analysis

max time kernel
124s
max time network
127s
platform
windows10_x64
resource
win10v200722
submitted
09/10/2020, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HpOgS.pdf.dll
Size 220KB
Sample201009-e49pmr6jfa
SHA256 83d5ceb21e632bda8a75388aad568444c414f2e06e96e73863bdccbefc48d17a
MD5 4a4554207ac6a6703b5cde6577e7a6bd
SHA1 1b958968f9e2572bf8ab8a33efb35c4c6e0d799a
SHA512 dc011bcbefdd0ba1f990fc65e1de59baf6353f9640ca4aaa93f7e669d7e8ec81a61b48c50b3250d876092f2e104a08e1bec414e54f42029424de8a093e97b6a9
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 12 IoCs

flow	pid	Process
15	3968	rundll32.exe
17	3968	rundll32.exe
19	3968	rundll32.exe
21	3968	rundll32.exe
23	3968	rundll32.exe
26	3968	rundll32.exe
27	3968	rundll32.exe
29	3968	rundll32.exe
31	3968	rundll32.exe
33	3968	rundll32.exe
35	3968	rundll32.exe
37	3968	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3968	rundll32.exe
3968	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 3968	3816	rundll32.exe	67
PID 3816 wrote to memory of 3968	3816	rundll32.exe	67
PID 3816 wrote to memory of 3968	3816	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HpOgS.pdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HpOgS.pdf.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads