4b931b39b584ba3ad6584c9c93f8f58b708225384d35ced025cb4eda55311618

Analysis

Target

E3-20191210_121355.dll
Size

239KB
MD5

142d5ba556836b61131e9e99421f7e46
SHA1

8a96f76b77134e848617f086e0d1bccb65a63f11
SHA256

74781ef4b04689d9782c61c4ce5f28cd055e00ef234da80bc465f5bc79f04c3b
SHA512

71ca536197270d52e289e6a82f61a2f19cf520f07acc7ec9392df5603896d0425c498d870ec3e93619b3b271fe8b09047bc49ad8a002a53389da2586fa3b737f

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

11 3144 rundll32.exe
14 3144 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Lookop\ywrgu.ahh rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

3144 rundll32.exe
3144 rundll32.exe
3144 rundll32.exe
3144 rundll32.exe
3144 rundll32.exe
3144 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1004 rundll32.exe

flow	pid	process
11	3144	rundll32.exe
14	3144	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Lookop\ywrgu.ahh	rundll32.exe

pid	process
1004	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 644 wrote to memory of 1004	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 1004	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 1004	644	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 3144	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 3144	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 3144	1004	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\E3-20191210_121355.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:644