152265b11b39688bfa5dd656dddacf87c01515f70f62aeb3b1406138a77986d5

Analysis

Target

eufive_20210725-084051.exe
Size

1010KB
MD5

1c52aed4df30df05a45966183eeef3c2
SHA1

11f350112bdd668b11b2fb3849ef2b0c7c020bb4
SHA256

152265b11b39688bfa5dd656dddacf87c01515f70f62aeb3b1406138a77986d5
SHA512

7c30a710cdf9e7f7043b1e4a8a9c1af9e2c70570dd428691451f908b0f81f2f4c3c71f691a2174ba339b1b713baa3ace3f65820402a91225387923f848665ab6

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

3 1932 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1932 rundll32.exe

flow	pid	process
3	1932	rundll32.exe

pid	process
1932	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

eufive_20210725-084051.exe

description	pid	process	target process
PID 1776 wrote to memory of 1932	1776	eufive_20210725-084051.exe	rundll32.exe
PID 1776 wrote to memory of 1932	1776	eufive_20210725-084051.exe	rundll32.exe
PID 1776 wrote to memory of 1932	1776	eufive_20210725-084051.exe	rundll32.exe
PID 1776 wrote to memory of 1932	1776	eufive_20210725-084051.exe	rundll32.exe
PID 1776 wrote to memory of 1932	1776	eufive_20210725-084051.exe	rundll32.exe
PID 1776 wrote to memory of 1932	1776	eufive_20210725-084051.exe	rundll32.exe
PID 1776 wrote to memory of 1932	1776	eufive_20210725-084051.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\eufive_20210725-084051.exe
"C:\Users\Admin\AppData\Local\Temp\eufive_20210725-084051.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Users\Admin\AppData\Local\Temp\EUFIVE~1.TMP
MD5
c6a1acce3f89edea61b44ecf55dbc003

SHA1
c5f07041f44922269d6b343f67683d9d343bda46

SHA256
0abf70595efc6d1013e0edc1cc6208df3291db180a41814b367bda9b2f741441

SHA512
1d43df1ca71689e4c56b9c6292ccf75165c0724ebc82483d65eda8d4534e15964d53dc99158172457962e2a4850f58b58509bab0d7233d5002d850cd746b1843

Download Submit
\Users\Admin\AppData\Local\Temp\EUFIVE~1.TMP
MD5
c6a1acce3f89edea61b44ecf55dbc003

SHA1
c5f07041f44922269d6b343f67683d9d343bda46

SHA256
0abf70595efc6d1013e0edc1cc6208df3291db180a41814b367bda9b2f741441

SHA512
1d43df1ca71689e4c56b9c6292ccf75165c0724ebc82483d65eda8d4534e15964d53dc99158172457962e2a4850f58b58509bab0d7233d5002d850cd746b1843

Download Submit
memory/1776-60-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/1932-61-0x0000000000000000-mapping.dmp

Download
memory/1932-65-0x0000000001DB0000-0x0000000001F0D000-memory.dmp

Filesize
1.4MB

Download