aec978b1d7a4e019602887ee759f224078c6938e2086c136efbfadaa286938e7

Analysis

Target
cfb3b161aa1c622775e4658a29b62844.exe
Size 1.2MB
Sample210729-plps5y2xes
SHA256 aec978b1d7a4e019602887ee759f224078c6938e2086c136efbfadaa286938e7
MD5 cfb3b161aa1c622775e4658a29b62844
SHA1 b28ae37bc7ba4fb0579df7bd2670f1a75744b658
SHA512 f93b5ee9a419fe0144b1e5c22055f98cdbda6fdeb8e774e0ec2ea6fd3038303e7d69fc120849398efa53a817411e4f45ae74e0834dbdcb7f2052b70ce2caf5cd
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
14	3884	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
3884	rundll32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Jvgzbfh.tmp	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 3884	3916	cfb3b161aa1c622775e4658a29b62844.exe	76
PID 3916 wrote to memory of 3884	3916	cfb3b161aa1c622775e4658a29b62844.exe	76
PID 3916 wrote to memory of 3884	3916	cfb3b161aa1c622775e4658a29b62844.exe	76

C:\Users\Admin\AppData\Local\Temp\cfb3b161aa1c622775e4658a29b62844.exe
"C:\Users\Admin\AppData\Local\Temp\cfb3b161aa1c622775e4658a29b62844.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\CFB3B1~1.TMP,S C:\Users\Admin\AppData\Local\Temp\CFB3B1~1.EXE
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:3884

memory/3916-114-0x0000000005100000-0x00000000051FF000-memory.dmp

Download

memory/3916-115-0x0000000000400000-0x000000000332A000-memory.dmp

Download