6baa699f3896ec02629c42551aef3e4bfa1935e93d164eef7d32b2054114e8a2 | Triage

Analysis

max time kernel
147s
max time network
151s
platform
windows7_x64
resource
win7v20201028
submitted
13-01-2021 07:18

Sharing

Report Analysis Logs

General

Target

50953c3dd8666db518f3bc1546b2fcb9.dll
Size

275KB
MD5

50953c3dd8666db518f3bc1546b2fcb9
SHA1

c4227399135948da753e3e2b59a816a6673ece86
SHA256

6baa699f3896ec02629c42551aef3e4bfa1935e93d164eef7d32b2054114e8a2
SHA512

eecbaedc88e95f955d72102161c0ef1270dec331aed8c2fbd28c1d8e80407b9efdc02beb12e6fa51e5395a0026ddfdb0c42d773fa0fb23dfa308b4fa8f6ed418

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

6 1748 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1748 rundll32.exe
1748 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1424 wrote to memory of 1748	1424	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 1748	1424	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 1748	1424	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 1748	1424	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 1748	1424	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 1748	1424	rundll32.exe	rundll32.exe
PID 1424 wrote to memory of 1748	1424	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50953c3dd8666db518f3bc1546b2fcb9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50953c3dd8666db518f3bc1546b2fcb9.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-3-0x000007FEF74A0000-0x000007FEF771A000-memory.dmp

Filesize
2.5MB

Download
memory/1748-2-0x0000000000000000-mapping.dmp

Download