6aac3f272eb5c624a17e86377b2b6b5f8ea2331c865c51c8de111e0b7be3d9a3

Analysis

Target

E1-20210112_221451.dll
Size

331KB
MD5

2375a730cb7a33413aba7447daa16bf6
SHA1

b4e51c782824d40cd736b0963e516567ac6a5d88
SHA256

e84ddc7edcac189655963d665bb2283847f6e1ccbbee1a96b23adaa2b65b04a9
SHA512

3c418fd0ad364d8b23b3a5829f293caf6fdac9fb37c20b69e6b474b3ebbed45136712110b32d5b3cb1cf58a815bb68c9f2d4a82e92cfeccd7584f3ea9ede9d94

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

10 3752 rundll32.exe
12 3752 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Xzydipkidm\bghswxjqq.szl rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

3752 rundll32.exe
3752 rundll32.exe
3752 rundll32.exe
3752 rundll32.exe
3752 rundll32.exe
3752 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1032 rundll32.exe

flow	pid	process
10	3752	rundll32.exe
12	3752	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Xzydipkidm\bghswxjqq.szl	rundll32.exe

pid	process
1032	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 508 wrote to memory of 1032	508	rundll32.exe	rundll32.exe
PID 508 wrote to memory of 1032	508	rundll32.exe	rundll32.exe
PID 508 wrote to memory of 1032	508	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 3752	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 3752	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 3752	1032	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\E1-20210112_221451.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\E1-20210112_221451.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Xzydipkidm\bghswxjqq.szl",ShowDialogA
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3752