Analysis
- max time kernel
118s - max time network
121s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
24/11/2021, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
145a3e1678b2367ac018f0d9e1bd9c73.dll
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
- Target 145a3e1678b2367ac018f0d9e1bd9c73.dll
- Size 416KB
- Sample211124-s77adsdagn
- SHA256 3563c9d1361cb4e8151a46084a33d15d2d9964e58c4df81f905ee2f9c99d082d
- MD5 145a3e1678b2367ac018f0d9e1bd9c73
- SHA1 8bd4dd0f0865a1f0dda3ba5afe703695b32a7c81
- SHA512 33d17c98637ea0c6a8b7ad9d9216e01c3caaeb6d2a327df965b2126183d2a8469dce38487776e489c1c10330e418992e0b7478db2aea4c3ac4d72a9b6875032b
- MD5 SHA1 SHA512
Malware Config
Signatures
- suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
- Blocklisted process makes network request 10 IoCs
flow pid Process 4 1180 rundll32.exe 6 1180 rundll32.exe 7 1180 rundll32.exe 8 1180 rundll32.exe 9 1180 rundll32.exe 10 1180 rundll32.exe 11 1180 rundll32.exe 12 1180 rundll32.exe 16 1180 rundll32.exe 18 1180 rundll32.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1180 rundll32.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 376 wrote to memory of 660 376 rundll32.exe 28 PID 376 wrote to memory of 660 376 rundll32.exe 28 PID 376 wrote to memory of 660 376 rundll32.exe 28 PID 376 wrote to memory of 660 376 rundll32.exe 28 PID 376 wrote to memory of 660 376 rundll32.exe 28 PID 376 wrote to memory of 660 376 rundll32.exe 28 PID 376 wrote to memory of 660 376 rundll32.exe 28 PID 660 wrote to memory of 780 660 rundll32.exe 29 PID 660 wrote to memory of 780 660 rundll32.exe 29 PID 660 wrote to memory of 780 660 rundll32.exe 29 PID 660 wrote to memory of 780 660 rundll32.exe 29 PID 660 wrote to memory of 780 660 rundll32.exe 29 PID 660 wrote to memory of 780 660 rundll32.exe 29 PID 660 wrote to memory of 780 660 rundll32.exe 29 PID 780 wrote to memory of 640 780 rundll32.exe 30 PID 780 wrote to memory of 640 780 rundll32.exe 30 PID 780 wrote to memory of 640 780 rundll32.exe 30 PID 780 wrote to memory of 640 780 rundll32.exe 30 PID 780 wrote to memory of 640 780 rundll32.exe 30 PID 780 wrote to memory of 640 780 rundll32.exe 30 PID 780 wrote to memory of 640 780 rundll32.exe 30 PID 640 wrote to memory of 1180 640 rundll32.exe 31 PID 640 wrote to memory of 1180 640 rundll32.exe 31 PID 640 wrote to memory of 1180 640 rundll32.exe 31 PID 640 wrote to memory of 1180 640 rundll32.exe 31 PID 640 wrote to memory of 1180 640 rundll32.exe 31 PID 640 wrote to memory of 1180 640 rundll32.exe 31 PID 640 wrote to memory of 1180 640 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\145a3e1678b2367ac018f0d9e1bd9c73.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\145a3e1678b2367ac018f0d9e1bd9c73.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\145a3e1678b2367ac018f0d9e1bd9c73.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\145a3e1678b2367ac018f0d9e1bd9c73.dll",Control_RunDLL4⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\145a3e1678b2367ac018f0d9e1bd9c73.dll",Control_RunDLL5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1180
-
-
-
-