1256cd8773234155c67ed3293c81b926d2d16d94960dfb7ea9f2df14b6a7f27d | Triage

Analysis

max time kernel
17s
max time network
133s
platform
windows7_x64
resource
win7v20201028
submitted
14-01-2021 00:03

Sharing

Report Analysis Logs

General

Target

emotet_exe_e3_1256cd8773234155c67ed3293c81b926d2d16d94960dfb7ea9f2df14b6a7f27d_2021-01-14__000231.exe.dll
Size

278KB
MD5

666bee305fc67f19cfa59236ffa9e0fe
SHA1

43800c7777f68cfb96a5317da9405eae0f43f301
SHA256

1256cd8773234155c67ed3293c81b926d2d16d94960dfb7ea9f2df14b6a7f27d
SHA512

6d4df799e0e2d8aaed795f03711bdb4878cef08e038fc507af95f99a8a52f7d655743814a1f8ae3ad229766513ecc12553429f48bf226567dcf29a60ee88796e

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

7 2012 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2012 rundll32.exe
2012 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1120 wrote to memory of 2012	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 2012	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 2012	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 2012	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 2012	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 2012	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 2012	1120	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_1256cd8773234155c67ed3293c81b926d2d16d94960dfb7ea9f2df14b6a7f27d_2021-01-14__000231.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_1256cd8773234155c67ed3293c81b926d2d16d94960dfb7ea9f2df14b6a7f27d_2021-01-14__000231.exe.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1604-3-0x000007FEF7AA0000-0x000007FEF7D1A000-memory.dmp

Filesize
2.5MB

Download
memory/2012-2-0x0000000000000000-mapping.dmp

Download