6541580253433e76eea2fdfa5fa2e02a703ee53e8550cbc779a506566e92628c | Triage™

Analysis

max time kernel
22s
max time network
132s
platform
windows10_x64
resource
win10v20201028
submitted
12/01/2021, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ddf61a63a5eabaea5be8a52b7ce18258.dll
Size 275KB
Sample210112-53653teels
SHA256 6541580253433e76eea2fdfa5fa2e02a703ee53e8550cbc779a506566e92628c
MD5 ddf61a63a5eabaea5be8a52b7ce18258
SHA1 984f26141c0a6acecb271b3df92f25cf9047c00d
SHA512 c11fe5f5e74844c9a4a644b7eabdd43c379b847630ebd599b78216173ef98e1b6b1db02b4444bcb643da881d3fd5e5e35aefa26ef2fc397b10a01a5c8801cd02
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
15	2280	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2280	rundll32.exe
2280	rundll32.exe
2280	rundll32.exe
2280	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 2280	4092	rundll32.exe	29
PID 4092 wrote to memory of 2280	4092	rundll32.exe	29
PID 4092 wrote to memory of 2280	4092	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddf61a63a5eabaea5be8a52b7ce18258.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddf61a63a5eabaea5be8a52b7ce18258.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads