23e672e1c94cc4dc6af971fc62c0ec84c3bcf38e997acd9bea1bea72d707e46a | Triage™

Analysis

max time kernel
150s
max time network
147s
platform
windows10_x64
resource
win10v200722
submitted
13/10/2020, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adSDv.txt.dll
Size 120KB
Sample201013-wqwexkvm56
SHA256 23e672e1c94cc4dc6af971fc62c0ec84c3bcf38e997acd9bea1bea72d707e46a
MD5 2984b74d65766064dc875b70e8778fe3
SHA1 3e191456cbeea5f212bccf4f203f5950762d9919
SHA512 e4e6cded79498b6dc6f6001bd1cfa65fa883c0f76b98a6b1d03687333dba4ce641153154517d4320b496243dfe28019bcd34b0e0f0e4c0224fb56ddbf8c2e3fd
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 10 IoCs

flow	pid	Process
13	1004	rundll32.exe
15	1004	rundll32.exe
17	1004	rundll32.exe
19	1004	rundll32.exe
21	1004	rundll32.exe
23	1004	rundll32.exe
25	1004	rundll32.exe
27	1004	rundll32.exe
29	1004	rundll32.exe
33	1004	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1004	rundll32.exe
1004	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 1004	560	rundll32.exe	67
PID 560 wrote to memory of 1004	560	rundll32.exe	67
PID 560 wrote to memory of 1004	560	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\adSDv.txt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\adSDv.txt.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads