4b931b39b584ba3ad6584c9c93f8f58b708225384d35ced025cb4eda55311618

Analysis

Target

E2-20210112_211117.dll
Size

326KB
MD5

0ee5c78c6e2ee9f8a8c201474fd03b2e
SHA1

b9ee4779a250c3b12178ea84bb406073acc1e65a
SHA256

2ddb9f69277cc1e2d2d2fe68462774b793dba5ef2c4857f4d7cc1023900c5f36
SHA512

081395800148b74f7c1a82948417e98a0016642a75e7e3c13e9255d66594550befe6f12dbd564ec6aa6ede01f53c45c97d7e9864c58762102ff6cf6d0d56a261

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

14 4172 rundll32.exe
18 4172 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Ixhgetgykewabpu\wurzoscfkilpbo.orx rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

4172 rundll32.exe
4172 rundll32.exe
4172 rundll32.exe
4172 rundll32.exe
4172 rundll32.exe
4172 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

4804 rundll32.exe

flow	pid	process
14	4172	rundll32.exe
18	4172	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Ixhgetgykewabpu\wurzoscfkilpbo.orx	rundll32.exe

pid	process
4804	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 4648 wrote to memory of 4804	4648	rundll32.exe	rundll32.exe
PID 4648 wrote to memory of 4804	4648	rundll32.exe	rundll32.exe
PID 4648 wrote to memory of 4804	4648	rundll32.exe	rundll32.exe
PID 4804 wrote to memory of 4200	4804	rundll32.exe	rundll32.exe
PID 4804 wrote to memory of 4200	4804	rundll32.exe	rundll32.exe
PID 4804 wrote to memory of 4200	4804	rundll32.exe	rundll32.exe
PID 4200 wrote to memory of 4172	4200	rundll32.exe	rundll32.exe
PID 4200 wrote to memory of 4172	4200	rundll32.exe	rundll32.exe
PID 4200 wrote to memory of 4172	4200	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\E2-20210112_211117.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Ixhgetgykewabpu\wurzoscfkilpbo.orx",PqhT
3⤵
- Suspicious use of WriteProcessMemory
PID:4200