2b63d2647bad3c232f9cb3bd169cee4fe1ecfd97cd4b88abab6b8167c126a33b | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10_x64
resource
win10v20201028
submitted
14-01-2021 06:35

Sharing

Report Analysis Logs

General

Target

b3efa3ec445197525edd5dca76f181e6.dll
Size

278KB
MD5

b3efa3ec445197525edd5dca76f181e6
SHA1

4e3795a286daad61cc00766b4f93dc3edb409a8f
SHA256

2b63d2647bad3c232f9cb3bd169cee4fe1ecfd97cd4b88abab6b8167c126a33b
SHA512

3c73ac98c11a8a9df404f4fc5f44e28b0428303cbb502f0ff42d63a81235618384dea28d20c2adb95d5bbcc1e4c393a15faf34372092c73d71a76b2dd4c0f785

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

14 848 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

848 rundll32.exe
848 rundll32.exe
848 rundll32.exe
848 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1812 wrote to memory of 848	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 848	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 848	1812	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3efa3ec445197525edd5dca76f181e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3efa3ec445197525edd5dca76f181e6.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-2-0x0000000000000000-mapping.dmp

Download