d1fda056497b19c20e4b7bf006bd6403462faaa1af7c1e05ae3d0897b3bb7b3b | Triage™

Analysis

max time kernel
150s
max time network
92s
platform
windows10_x64
resource
win10
submitted
09/10/2020, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KXyGJ.pdf.dll
Size 220KB
Sample201009-pyb2yhs5d2
SHA256 d1fda056497b19c20e4b7bf006bd6403462faaa1af7c1e05ae3d0897b3bb7b3b
MD5 16a7f439b61fbf88b20d18d9187c53e2
SHA1 d29876bf83912ae1f472db5c83e0e563f9ad0dd6
SHA512 8855c244f16106cf19f5a2c1e34ac14a6f360c351af2b70c8c5bd74f786effffc3e8ca6ec2a4d0d164690f817387ffe62b5a217e09feb42c2503420f0ea4f503
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 11 IoCs

flow	pid	Process
9	3988	rundll32.exe
11	3988	rundll32.exe
13	3988	rundll32.exe
15	3988	rundll32.exe
17	3988	rundll32.exe
19	3988	rundll32.exe
21	3988	rundll32.exe
23	3988	rundll32.exe
25	3988	rundll32.exe
27	3988	rundll32.exe
29	3988	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3988	rundll32.exe
3988	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 3988	3676	rundll32.exe	69
PID 3676 wrote to memory of 3988	3676	rundll32.exe	69
PID 3676 wrote to memory of 3988	3676	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KXyGJ.pdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KXyGJ.pdf.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads