6aac3f272eb5c624a17e86377b2b6b5f8ea2331c865c51c8de111e0b7be3d9a3

Analysis

Target

E1-20210112_173733.dll
Size

331KB
MD5

08fdfe1ca632fa31140e2cbd84794bd5
SHA1

0c51aad4c21dc66cfc347d472b6d9768470ce4b1
SHA256

f93544c3fd1fbbcc9f0eca7960234a7d3ca56787410d8273ccb0aa42f2103e53
SHA512

0ea7341140b21bfb8e3463ffb852b45e4c27be427bd1a6e528da91c536d19559e83d6a7044fb7a2e3bf4c200a0869517a840eaf3d68a98523f983dfb0d52fdec

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

12 2272 rundll32.exe
16 2272 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2272 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Zzbkfnernfpzfoos\dhleyukvsetjxhu.zmd rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

2272 rundll32.exe
2272 rundll32.exe
2272 rundll32.exe
2272 rundll32.exe
2272 rundll32.exe
2272 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

4828 rundll32.exe

flow	pid	process
12	2272	rundll32.exe
16	2272	rundll32.exe

pid	process
2272	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Zzbkfnernfpzfoos\dhleyukvsetjxhu.zmd	rundll32.exe

pid	process
4828	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4688 wrote to memory of 4828	4688	rundll32.exe	rundll32.exe
PID 4688 wrote to memory of 4828	4688	rundll32.exe	rundll32.exe
PID 4688 wrote to memory of 4828	4688	rundll32.exe	rundll32.exe
PID 4828 wrote to memory of 2272	4828	rundll32.exe	rundll32.exe
PID 4828 wrote to memory of 2272	4828	rundll32.exe	rundll32.exe
PID 4828 wrote to memory of 2272	4828	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\E1-20210112_173733.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\E1-20210112_173733.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Zzbkfnernfpzfoos\dhleyukvsetjxhu.zmd",ShowDialogA
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2272

\Windows\SysWOW64\Zzbkfnernfpzfoos\dhleyukvsetjxhu.zmd

MD5
08fdfe1ca632fa31140e2cbd84794bd5

SHA1
0c51aad4c21dc66cfc347d472b6d9768470ce4b1

SHA256
f93544c3fd1fbbcc9f0eca7960234a7d3ca56787410d8273ccb0aa42f2103e53

SHA512
0ea7341140b21bfb8e3463ffb852b45e4c27be427bd1a6e528da91c536d19559e83d6a7044fb7a2e3bf4c200a0869517a840eaf3d68a98523f983dfb0d52fdec

Download Submit
memory/2272-3-0x0000000000000000-mapping.dmp

Download
memory/4828-2-0x0000000000000000-mapping.dmp

Download