aee6295dab6fd012e5bd1ee352317e56bef5789e2e83e7d5cc743161cedd957b | Triage™

Analysis

max time kernel
147s
max time network
147s
platform
windows10_x64
resource
win10v200722
submitted
13/10/2020, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adSDv.txt.dll
Size 120KB
Sample201013-7xvs35gnea
SHA256 aee6295dab6fd012e5bd1ee352317e56bef5789e2e83e7d5cc743161cedd957b
MD5 bcfc0b44af8595fa96d65e99a162aa54
SHA1 ca4e1439ee72b82d31ac348c805d4d87c1622fd7
SHA512 b1d8fac11f0470aeb20f6c520e5f5f087eba5c1c691a1dbb24dd2a3f1c44981a9488d3964481c2cf3c74fd3e9e243b5f2f0c7ee0418c60f35c1f787ce1e3a54e
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 12 IoCs

flow	pid	Process
13	904	rundll32.exe
15	904	rundll32.exe
17	904	rundll32.exe
19	904	rundll32.exe
21	904	rundll32.exe
23	904	rundll32.exe
25	904	rundll32.exe
27	904	rundll32.exe
29	904	rundll32.exe
31	904	rundll32.exe
33	904	rundll32.exe
35	904	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
904	rundll32.exe
904	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 904	1568	rundll32.exe	69
PID 1568 wrote to memory of 904	1568	rundll32.exe	69
PID 1568 wrote to memory of 904	1568	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\adSDv.txt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\adSDv.txt.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads