bc372fa87f04bec52c7294a2aa9b30e27b7ba1a4eccfb8d0be2883f4090cf786

Analysis

Target
90a0498b6351dd26caf13325fd1ab92e39dd7ba3f390ac6500602a3223b4f64d.dll
Size 112KB
Sample200717-be2mzc2s26
SHA256 bc372fa87f04bec52c7294a2aa9b30e27b7ba1a4eccfb8d0be2883f4090cf786
MD5 1afa83672326b8b18432c635c08fe3ba
SHA1 480b17e16a5e7cd14e4796d682bba2dbf6e0d320
SHA512 d36b3ce52d76ee2524ba1a3f58df052242cce5be5d6328ab5642bd3cfc9bdee37cc45e123697686d827d33e710d1170a050a89a67791dbc5f7665525b3c4c70e
MD5 SHA1 SHA512

Score

8^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 3220	2040	rundll32.exe	68
PID 2040 wrote to memory of 3220	2040	rundll32.exe	68
PID 2040 wrote to memory of 3220	2040	rundll32.exe	68

Blacklisted process makes network request 11 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3220	rundll32.exe
3220	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90a0498b6351dd26caf13325fd1ab92e39dd7ba3f390ac6500602a3223b4f64d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90a0498b6351dd26caf13325fd1ab92e39dd7ba3f390ac6500602a3223b4f64d.dll,#1
  2⤵
  - Blacklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3220