6aac3f272eb5c624a17e86377b2b6b5f8ea2331c865c51c8de111e0b7be3d9a3

Analysis

Target

E3-20210112_230555.dll
Size

336KB
MD5

962e0d4d1c8e6d42950021cf2d032684
SHA1

8be9c398a040aa9b42d49397f0ed604bb06e75c6
SHA256

c03830226f73e3fba25c8f00c9957ae2d4fdd34d9a4936d7517878f38cfeaf81
SHA512

de989a5cdebc7147965547d960672438a6dcf7adf032efa5decb45ce3084975f48f159cd01f84989e6248cbc079390def302e542a54393c3128a0f86a702a620

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

8 1156 rundll32.exe
14 1156 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Lecqugxwx\xmrbptlx.nyl rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

1156 rundll32.exe
1156 rundll32.exe
1156 rundll32.exe
1156 rundll32.exe
1156 rundll32.exe
1156 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1332 rundll32.exe

flow	pid	process
8	1156	rundll32.exe
14	1156	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Lecqugxwx\xmrbptlx.nyl	rundll32.exe

pid	process
1332	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1108 wrote to memory of 1332	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1332	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1332	1108	rundll32.exe	rundll32.exe
PID 1332 wrote to memory of 1156	1332	rundll32.exe	rundll32.exe
PID 1332 wrote to memory of 1156	1332	rundll32.exe	rundll32.exe
PID 1332 wrote to memory of 1156	1332	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\E3-20210112_230555.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\E3-20210112_230555.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Lecqugxwx\xmrbptlx.nyl",ShowDialogA
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:1156