4bbab985fdd9eee28a8a9951080d28c2b51de13ad5e42c471e9933d9b596eacc

Analysis

Target
opra.doc.dll
Size 209KB
Sample220120-vrzxgsagg7
SHA256 4bbab985fdd9eee28a8a9951080d28c2b51de13ad5e42c471e9933d9b596eacc
MD5 a16e7e2cdb9571cf0470324984b53146
SHA1 757d174a82da0c8412b80c5afffdb4ffdb2a13f2
SHA512 2638d24cacebdfbe183db6c0a15a997ab5d351ccb441d9fa6b460c7e4c1b3c5411f00a5560090c255dc975c6c716fa6caad0fde0a9e71633369bd338002be7a6
MD5 SHA1 SHA512

Score

1^/10

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1188	timeout.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 640	1600	rundll32.exe	29
PID 1600 wrote to memory of 640	1600	rundll32.exe	29
PID 1600 wrote to memory of 640	1600	rundll32.exe	29
PID 640 wrote to memory of 1188	640	cmd.exe	31
PID 640 wrote to memory of 1188	640	cmd.exe	31
PID 640 wrote to memory of 1188	640	cmd.exe	31
PID 640 wrote to memory of 1368	640	cmd.exe	32
PID 640 wrote to memory of 1368	640	cmd.exe	32
PID 640 wrote to memory of 1368	640	cmd.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\opra.doc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\system32\cmd.exe
  cmd /c timeout 5 & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\opra.doc.dll", #1 wD6bUqfE kO5rG7fD & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\system32\timeout.exe
    timeout 5
    3⤵
    - Delays execution with timeout.exe
    PID:1188
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\opra.doc.dll", #1 wD6bUqfE kO5rG7fD
    3⤵
    PID:1368

memory/1600-54-0x0000000001BF0000-0x0000000001C10000-memory.dmp

Download