6aac3f272eb5c624a17e86377b2b6b5f8ea2331c865c51c8de111e0b7be3d9a3

Analysis

Target

E3-20210112_211123.dll
Size

335KB
MD5

349b0c75039858ff7ff98a42a6ac8884
SHA1

cb755ec802537917690f8b35e31da1a0529721e6
SHA256

cdb34f43d85a8a663d7e1d21b250a81c905a4101e4736fc27fa36bafa35121c8
SHA512

4f2d0c7a4df58ac8444ff8452502f50dd498ac110f9f9e1ef7cbc1ecb807ef195ddc5ef0f5f6b82048093e477ef591a9dc56f44f7fddc1b008b43e9a4d1ed55d

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

12 3796 rundll32.exe
16 3796 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Ubawi\dfnk.mlc rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

3796 rundll32.exe
3796 rundll32.exe
3796 rundll32.exe
3796 rundll32.exe
3796 rundll32.exe
3796 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1056 rundll32.exe

flow	pid	process
12	3796	rundll32.exe
16	3796	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Ubawi\dfnk.mlc	rundll32.exe

pid	process
1056	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 3300 wrote to memory of 1056	3300	rundll32.exe	rundll32.exe
PID 3300 wrote to memory of 1056	3300	rundll32.exe	rundll32.exe
PID 3300 wrote to memory of 1056	3300	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 748	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 748	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 748	1056	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 3796	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 3796	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 3796	748	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\E3-20210112_211123.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\E3-20210112_211123.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Ubawi\dfnk.mlc",SxzqrxHsSw
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Ubawi\dfnk.mlc",#1
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      PID:3796