3b8dd3bc950e31064f5fe058ed3e8c25f082bef1f42e1426760cc6f8fef14821

Analysis

Target
3b8dd3bc950e31064f5fe058ed3e8c25f082bef1f42e1.dll
Size 19KB
Sample210331-5qg4ftcapj
SHA256 3b8dd3bc950e31064f5fe058ed3e8c25f082bef1f42e1426760cc6f8fef14821
MD5 1e3d729aefe43012af8f4b8d4ae78c64
SHA1 9ce0416256b3b41df4015c5df56122790fd93ca5
SHA512 cdbb91e799a119cd3f6b9b09bec294607fd0d456baffc16adb9d02231a5a0a1bb031018da5e6e16bf4ecfa6e8fd408f5e95eeab42c0472109aa0e96a80a2bb44
MD5 SHA1 SHA512

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\edge.job	notepad.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 2008	776	rundll32.exe	25
PID 776 wrote to memory of 2008	776	rundll32.exe	25
PID 776 wrote to memory of 2008	776	rundll32.exe	25
PID 776 wrote to memory of 2008	776	rundll32.exe	25
PID 776 wrote to memory of 2008	776	rundll32.exe	25
PID 776 wrote to memory of 2008	776	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b8dd3bc950e31064f5fe058ed3e8c25f082bef1f42e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  - Drops file in Windows directory
  PID:2008

memory/1712-6-0x000007FEF6010000-0x000007FEF628A000-memory.dmp

Download

memory/2008-2-0x0000000000070000-0x0000000000073000-memory.dmp

Download

memory/2008-4-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

Download