Analysis
-
max time kernel
12s -
max time network
22s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 07:29
Static task
static1
Behavioral task
behavioral1
Sample
bdfad845fedfca63410c0f552a7f00b6d3765dc6cae7c17fe591fa6719b390e0.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
bdfad845fedfca63410c0f552a7f00b6d3765dc6cae7c17fe591fa6719b390e0.dll
-
Size
239KB
-
MD5
8d8f420ee1d7f8274acf9bd4a4ff4759
-
SHA1
4738e8171facfef538b78e1bf03eaaaa29c79902
-
SHA256
bdfad845fedfca63410c0f552a7f00b6d3765dc6cae7c17fe591fa6719b390e0
-
SHA512
b00ca9f9a9bf73e589a883b53ed736f7f0315922f024ac9e0d05f8d238e5252102011528cdf2a7eb3627fdff2c5bebb0db50b6dbbf2dd1d1abeb363b8a75f21e
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 14 4748 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 4748 rundll32.exe 4748 rundll32.exe 4748 rundll32.exe 4748 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4700 wrote to memory of 4748 4700 rundll32.exe rundll32.exe PID 4700 wrote to memory of 4748 4700 rundll32.exe rundll32.exe PID 4700 wrote to memory of 4748 4700 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bdfad845fedfca63410c0f552a7f00b6d3765dc6cae7c17fe591fa6719b390e0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bdfad845fedfca63410c0f552a7f00b6d3765dc6cae7c17fe591fa6719b390e0.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4748
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4748-2-0x0000000000000000-mapping.dmp