5db3ac792d42915d21bec4eabb98e92534ba7da4bc5174035f13b92ef5e5625d | Triage

Analysis

max time kernel
25s
max time network
28s
platform
windows10_x64
resource
win10v20201028
submitted
13-01-2021 07:29

Sharing

Report Analysis Logs

General

Target

5db3ac792d42915d21bec4eabb98e92534ba7da4bc5174035f13b92ef5e5625d.dll
Size

239KB
MD5

336cacba7db83dcdd7b181bfd1a31606
SHA1

e9b5f803adb579f38525d729ed14c1f6818e01f7
SHA256

5db3ac792d42915d21bec4eabb98e92534ba7da4bc5174035f13b92ef5e5625d
SHA512

efe3e27982b16e451d37c5dbb8047f3375bc2f986415fd774cf3de39cf0a46580d77026bbffe82540e6fbd27985ec5f4fed973784d7083ccc40890dbfd90822e

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

11 4776 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

4776 rundll32.exe
4776 rundll32.exe
4776 rundll32.exe
4776 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4708 wrote to memory of 4776	4708	rundll32.exe	rundll32.exe
PID 4708 wrote to memory of 4776	4708	rundll32.exe	rundll32.exe
PID 4708 wrote to memory of 4776	4708	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5db3ac792d42915d21bec4eabb98e92534ba7da4bc5174035f13b92ef5e5625d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5db3ac792d42915d21bec4eabb98e92534ba7da4bc5174035f13b92ef5e5625d.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4776-2-0x0000000000000000-mapping.dmp

Download