6aac3f272eb5c624a17e86377b2b6b5f8ea2331c865c51c8de111e0b7be3d9a3

Analysis

Target

E2-20210112_211117.dll
Size

326KB
MD5

c4a8911d28912ce37a105b3d7c03ce40
SHA1

8516a73f008136ba8eccaa74bd64d5016a7b3d06
SHA256

726051e45495e6c807696107009e4875a01b2df99f36e0a296da8ee39ae3f9a3
SHA512

68db8affb199b6f7acfdd7f41fae017da6462fc60c8c14d6c5673ec8f44c72f9a2ededba3a8682b637501cf6635efe571c04d76f861ae5b7a52cd6df09cad234

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

10 2584 rundll32.exe
14 2584 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Mtyjer\dovrf.uny rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

2584 rundll32.exe
2584 rundll32.exe
2584 rundll32.exe
2584 rundll32.exe
2584 rundll32.exe
2584 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

3972 rundll32.exe

flow	pid	process
10	2584	rundll32.exe
14	2584	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Mtyjer\dovrf.uny	rundll32.exe

pid	process
3972	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 3496 wrote to memory of 3972	3496	rundll32.exe	rundll32.exe
PID 3496 wrote to memory of 3972	3496	rundll32.exe	rundll32.exe
PID 3496 wrote to memory of 3972	3496	rundll32.exe	rundll32.exe
PID 3972 wrote to memory of 2256	3972	rundll32.exe	rundll32.exe
PID 3972 wrote to memory of 2256	3972	rundll32.exe	rundll32.exe
PID 3972 wrote to memory of 2256	3972	rundll32.exe	rundll32.exe
PID 2256 wrote to memory of 2584	2256	rundll32.exe	rundll32.exe
PID 2256 wrote to memory of 2584	2256	rundll32.exe	rundll32.exe
PID 2256 wrote to memory of 2584	2256	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\E2-20210112_211117.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\E2-20210112_211117.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Mtyjer\dovrf.uny",hpqnW
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Mtyjer\dovrf.uny",#1
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      PID:2584