affb2a5ec9ac782d9fa34c6d872d01fc0feb84b0685840e79039d67d97f8a48c | Triage

Analysis

max time kernel
17s
max time network
125s
platform
windows10_x64
resource
win10v20201028
submitted
14-01-2021 00:03

Sharing

Report Analysis Logs

General

Target

emotet_exe_e3_affb2a5ec9ac782d9fa34c6d872d01fc0feb84b0685840e79039d67d97f8a48c_2021-01-14__000231.exe.dll
Size

278KB
MD5

fc1e7c1d53c378c6adccc1ac3f117c26
SHA1

5014f820ba6f19c6ba09b52417885b03dac6aaf5
SHA256

affb2a5ec9ac782d9fa34c6d872d01fc0feb84b0685840e79039d67d97f8a48c
SHA512

37793c7930240e7946236842e8b9ee05db16ec4d58f9995872a2329ce3a8820525002135aa97d1b4d826620a821ac2abde6018bf64bf598adff7ebc1cd3d36c1

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

16 4040 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

4040 rundll32.exe
4040 rundll32.exe
4040 rundll32.exe
4040 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1028 wrote to memory of 4040	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 4040	1028	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 4040	1028	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_affb2a5ec9ac782d9fa34c6d872d01fc0feb84b0685840e79039d67d97f8a48c_2021-01-14__000231.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_affb2a5ec9ac782d9fa34c6d872d01fc0feb84b0685840e79039d67d97f8a48c_2021-01-14__000231.exe.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4040-2-0x0000000000000000-mapping.dmp

Download