4b931b39b584ba3ad6584c9c93f8f58b708225384d35ced025cb4eda55311618

Analysis

Target

E1-20191211_134358.dll
Size

275KB
MD5

69ed8109e063fa7a089cfacc9962c39c
SHA1

217c21471924628fc61700a982a7965fefc03900
SHA256

90b319245257e363713f031b792fe9bc2f56a718b8ce5c24a2e83e4ebeca66fb
SHA512

a44ade7a9fb6512d44182c596f40d9fe935a98070034d42d7a8ba0db40a81ec92a8f91c65bb4e04698462e9bd07e4088b901e238d9630a8a33f3424a5a88a537

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

12 2024 rundll32.exe
15 2024 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Nhdhgoaacsum\hyqdvyouyba.bpe rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

2024 rundll32.exe
2024 rundll32.exe
2024 rundll32.exe
2024 rundll32.exe
2024 rundll32.exe
2024 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1480 rundll32.exe

flow	pid	process
12	2024	rundll32.exe
15	2024	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Nhdhgoaacsum\hyqdvyouyba.bpe	rundll32.exe

pid	process
1480	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 744 wrote to memory of 1480	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 1480	744	rundll32.exe	rundll32.exe
PID 744 wrote to memory of 1480	744	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 2024	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 2024	1480	rundll32.exe	rundll32.exe
PID 1480 wrote to memory of 2024	1480	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\E1-20191211_134358.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744