Analysis
- max time kernel
143s - max time network
149s - platform
windows10_x64 - resource
win10v200722 - submitted
13/10/2020, 20:08
Static task
static1
Behavioral task
behavioral1
Sample
Cxvdv.txt.dll
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Cxvdv.txt.dll
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target Cxvdv.txt.dll
- Size 120KB
- Sample201013-xtvxqeb27s
- SHA256 435fb59379dcbbc4831926f93196705de81fa9ee6c7e106fe99d4ffd58f8fd28
- MD5 59d0ef2352bb73f774f7ff37ce757203
- SHA1 5841c64d1c0a29c99ee6b3e4384ba6c267f1e9a0
- SHA512 3b872e920ea86d2d2a51f9738889fe2dbce0ec58aec21b0ad26aac243f204e16193d9dba6e301779d1018d00fb5b245442cef274a919d9ff01a3cc4ad213268c
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 15 IoCs
flow pid Process 14 904 rundll32.exe 16 904 rundll32.exe 18 904 rundll32.exe 20 904 rundll32.exe 22 904 rundll32.exe 24 904 rundll32.exe 26 904 rundll32.exe 28 904 rundll32.exe 30 904 rundll32.exe 32 904 rundll32.exe 34 904 rundll32.exe 36 904 rundll32.exe 38 904 rundll32.exe 40 904 rundll32.exe 41 904 rundll32.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 904 rundll32.exe 904 rundll32.exe 904 rundll32.exe 904 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 648 wrote to memory of 904 648 rundll32.exe 67 PID 648 wrote to memory of 904 648 rundll32.exe 67 PID 648 wrote to memory of 904 648 rundll32.exe 67
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Cxvdv.txt.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Cxvdv.txt.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:904
-