6541580253433e76eea2fdfa5fa2e02a703ee53e8550cbc779a506566e92628c | Triage™

Analysis

max time kernel
41s
max time network
150s
platform
windows7_x64
resource
win7v20201028
submitted
12/01/2021, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ddf61a63a5eabaea5be8a52b7ce18258.dll
Size 275KB
Sample210112-53653teels
SHA256 6541580253433e76eea2fdfa5fa2e02a703ee53e8550cbc779a506566e92628c
MD5 ddf61a63a5eabaea5be8a52b7ce18258
SHA1 984f26141c0a6acecb271b3df92f25cf9047c00d
SHA512 c11fe5f5e74844c9a4a644b7eabdd43c379b847630ebd599b78216173ef98e1b6b1db02b4444bcb643da881d3fd5e5e35aefa26ef2fc397b10a01a5c8801cd02
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	1984	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1984	rundll32.exe
1984	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1984	744	rundll32.exe	26
PID 744 wrote to memory of 1984	744	rundll32.exe	26
PID 744 wrote to memory of 1984	744	rundll32.exe	26
PID 744 wrote to memory of 1984	744	rundll32.exe	26
PID 744 wrote to memory of 1984	744	rundll32.exe	26
PID 744 wrote to memory of 1984	744	rundll32.exe	26
PID 744 wrote to memory of 1984	744	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddf61a63a5eabaea5be8a52b7ce18258.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddf61a63a5eabaea5be8a52b7ce18258.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-3-0x000007FEF7900000-0x000007FEF7B7A000-memory.dmp

Download