6aac3f272eb5c624a17e86377b2b6b5f8ea2331c865c51c8de111e0b7be3d9a3

Analysis

Target

E3-20191210_121355.dll
Size

239KB
MD5

a857a067d464190f680aca4509ed083b
SHA1

6b9a44df07a564533616a70b17b24868ceab66f7
SHA256

11c8f11d1043c3a43be5057df084e29126d7a610bd4eccc4e639e4bcc1ba2cc2
SHA512

f80c9b639b57aaa62bd92a869dd2657e0a3c4278b6efc4474216d4875f6ab7a1cc5b86304a2636bdacc6c3feb0873eec2d386b3ad228ad661d2fafe06cdb9cfd

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

15 3192 rundll32.exe
18 3192 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Ouejagyg\cgnzwbv.kkp rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

3192 rundll32.exe
3192 rundll32.exe
3192 rundll32.exe
3192 rundll32.exe
3192 rundll32.exe
3192 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1220 rundll32.exe

flow	pid	process
15	3192	rundll32.exe
18	3192	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Ouejagyg\cgnzwbv.kkp	rundll32.exe

pid	process
1220	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 412 wrote to memory of 1220	412	rundll32.exe	rundll32.exe
PID 412 wrote to memory of 1220	412	rundll32.exe	rundll32.exe
PID 412 wrote to memory of 1220	412	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 3192	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 3192	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 3192	1220	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\E3-20191210_121355.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\E3-20191210_121355.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Ouejagyg\cgnzwbv.kkp",ShowDialogA
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3192