4b931b39b584ba3ad6584c9c93f8f58b708225384d35ced025cb4eda55311618

Analysis

Target

E1-20191210_102353.dll
Size

276KB
MD5

eb74d6e06e9923d605cb63f2dc037d62
SHA1

06f3a9a94a48a0b19374617de8f54dec55cd3307
SHA256

7c073c25d28eb332ba72fbc5424370dc6b87fd2dd737ec704871819936502954
SHA512

ff8b6a7c6668fd086b9bf8f9d873b1fadb2a5ba29ff537f85636a5ee481dead8af7205250128829b186704d899a41801f3ed69f37409ee6881ab8b2eff63d129

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

11 3152 rundll32.exe
14 3152 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Drwdozxmtkt\ltnxwdrsts.lyk rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

3152 rundll32.exe
3152 rundll32.exe
3152 rundll32.exe
3152 rundll32.exe
3152 rundll32.exe
3152 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

4844 rundll32.exe

flow	pid	process
11	3152	rundll32.exe
14	3152	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Drwdozxmtkt\ltnxwdrsts.lyk	rundll32.exe

pid	process
4844	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4700 wrote to memory of 4844	4700	rundll32.exe	rundll32.exe
PID 4700 wrote to memory of 4844	4700	rundll32.exe	rundll32.exe
PID 4700 wrote to memory of 4844	4700	rundll32.exe	rundll32.exe
PID 4844 wrote to memory of 3152	4844	rundll32.exe	rundll32.exe
PID 4844 wrote to memory of 3152	4844	rundll32.exe	rundll32.exe
PID 4844 wrote to memory of 3152	4844	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\E1-20191210_102353.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4700