7316bf4538e96c9a09d7a6a72e0ede7df34289a47b0561a23fa5b959638daefe | Triage™

Analysis

max time kernel
91s
max time network
113s
platform
windows10_x64
resource
win10
submitted
09/10/2020, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QAgOB.pdf.dll
Size 220KB
Sample201009-jbph3spw92
SHA256 7316bf4538e96c9a09d7a6a72e0ede7df34289a47b0561a23fa5b959638daefe
MD5 dfdbe1c86fb4cd721c3f67bc513d8afa
SHA1 0e8e1e67b55fe048c11613ddfd76f8bcb635de7d
SHA512 03bd95595cbdda20d424d5ae0bc5dca25b31f8891bc07d510e5fbcf1ca901a6318e78133e1fb7877780480d683825af7fade57a2c55b7fa43b64025d9ff9ae9d
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 12 IoCs

flow	pid	Process
13	3716	rundll32.exe
15	3716	rundll32.exe
17	3716	rundll32.exe
19	3716	rundll32.exe
21	3716	rundll32.exe
23	3716	rundll32.exe
24	3716	rundll32.exe
26	3716	rundll32.exe
28	3716	rundll32.exe
30	3716	rundll32.exe
32	3716	rundll32.exe
34	3716	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3716	rundll32.exe
3716	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 3716	1536	rundll32.exe	70
PID 1536 wrote to memory of 3716	1536	rundll32.exe	70
PID 1536 wrote to memory of 3716	1536	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QAgOB.pdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QAgOB.pdf.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads