e35b9feacfba1df802f9ed242775361f4317c22782f4e9e2dddd095577a72487 | Triage™

Analysis

max time kernel
61s
max time network
120s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libOmio.dll
Size 279KB
Sample201109-glsffdfkya
SHA256 e35b9feacfba1df802f9ed242775361f4317c22782f4e9e2dddd095577a72487
MD5 83b02e12a48b092f91788d7c253dd1c2
SHA1 acf4e3c3fd1772c7d4ebec32b38d018cce4e9707
SHA512 2346555b01a3f5da162dce7a8091e304a207965f1ad6d956e6fc0de1ad457c1bea0ee0b7fcba53fdc0155c021bba53213f585932c59d1a09b0c429e0e190318f
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 1 IoCs

flow	pid	Process
15	3604	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3604	rundll32.exe
3604	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 3604	3976	rundll32.exe	69
PID 3976 wrote to memory of 3604	3976	rundll32.exe	69
PID 3976 wrote to memory of 3604	3976	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libOmio.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libOmio.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads