6aac3f272eb5c624a17e86377b2b6b5f8ea2331c865c51c8de111e0b7be3d9a3

Analysis

Target

E2-20210112_230549.dll
Size

332KB
MD5

9cbfb794a1280a7219bcbc65d91b6c2c
SHA1

97aab5a9656874d173bad0b0eeed88472d5a0947
SHA256

989764326794814c77cf31f23f2e536cd49d316f9a143ad91fd21abf0a87f7b1
SHA512

870950078c279cb92ece88bb816bdc6ac6e17c918e2c332d77f032f08f3d7441b4dac456ea17a1bb2abd9e2d9a4c11569795f5e69a5614da95222cb45d2a553a

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

10 3556 rundll32.exe
13 3556 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Nhweoxugldl\hxvkygizar.unm rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

3556 rundll32.exe
3556 rundll32.exe
3556 rundll32.exe
3556 rundll32.exe
3556 rundll32.exe
3556 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1432 rundll32.exe

flow	pid	process
10	3556	rundll32.exe
13	3556	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Nhweoxugldl\hxvkygizar.unm	rundll32.exe

pid	process
1432	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 988 wrote to memory of 1432	988	rundll32.exe	rundll32.exe
PID 988 wrote to memory of 1432	988	rundll32.exe	rundll32.exe
PID 988 wrote to memory of 1432	988	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 3556	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 3556	1432	rundll32.exe	rundll32.exe
PID 1432 wrote to memory of 3556	1432	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\E2-20210112_230549.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\E2-20210112_230549.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Nhweoxugldl\hxvkygizar.unm",ShowDialogA
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3556