7519ecc88854cf96e369f110243fec46fbf20e8d1259ffaee06ef865f59a3aa7

Analysis

Target
curllib.dll
Size 597KB
Sample210212-krm92dqqf2
SHA256 7519ecc88854cf96e369f110243fec46fbf20e8d1259ffaee06ef865f59a3aa7
MD5 b39ec795237847c3f080eb45d146edb3
SHA1 d38da9f2e22df5d72488b00e3865e32df655bb56
SHA512 da3b9077fc40deb4dfada09168e0850ff0e07682afaf9edeee6c7653e83f1d9f7d8788ed7469f35b50c10868b7d4c78f74196f20b19d185e22f201efe29cb0cd
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 5 IoCs

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1504	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1504	1832	rundll32.exe	25
PID 1832 wrote to memory of 1504	1832	rundll32.exe	25
PID 1832 wrote to memory of 1504	1832	rundll32.exe	25
PID 1832 wrote to memory of 1504	1832	rundll32.exe	25
PID 1832 wrote to memory of 1504	1832	rundll32.exe	25
PID 1832 wrote to memory of 1504	1832	rundll32.exe	25
PID 1832 wrote to memory of 1504	1832	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\curllib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\curllib.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504

memory/1504-3-0x0000000076371000-0x0000000076373000-memory.dmp

Download

memory/1504-4-0x0000000010000000-0x000000001000D000-memory.dmp

Download