4b931b39b584ba3ad6584c9c93f8f58b708225384d35ced025cb4eda55311618

Analysis

Target

E3-20191210_102353.dll
Size

278KB
MD5

85859656fc6ad38cf55b415b656ee11b
SHA1

2fc3fb386e5f1192e9bd87c05a388a1a0aeaaedc
SHA256

855d84d494b9bfed3cc8e39d36042e2e7aa08d744b4298cb73470567f8bce2a2
SHA512

73a3a69b0ca60bc83b6cc73aadb9f425efa136fdc70ea8be3324af31006039a411841949f16dac23e5400d036f5c2f775b0e71e86ac272e017da96a500e3105b

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

10 3836 rundll32.exe
14 3836 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Dsijefvh\atbnmua.bcq rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

3836 rundll32.exe
3836 rundll32.exe
3836 rundll32.exe
3836 rundll32.exe
3836 rundll32.exe
3836 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

3604 rundll32.exe

flow	pid	process
10	3836	rundll32.exe
14	3836	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Dsijefvh\atbnmua.bcq	rundll32.exe

pid	process
3604	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3992 wrote to memory of 3604	3992	rundll32.exe	rundll32.exe
PID 3992 wrote to memory of 3604	3992	rundll32.exe	rundll32.exe
PID 3992 wrote to memory of 3604	3992	rundll32.exe	rundll32.exe
PID 3604 wrote to memory of 3836	3604	rundll32.exe	rundll32.exe
PID 3604 wrote to memory of 3836	3604	rundll32.exe	rundll32.exe
PID 3604 wrote to memory of 3836	3604	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\E3-20191210_102353.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3992