156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673

Resubmissions

02-02-2022 05:43

14-05-2021 06:27

Target

156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.bin.sample.dll
Size

54KB
MD5

f587adbd83ff3f4d2985453cd45c7ab1
SHA1

2715340f82426f840cf7e460f53a36fc3aad52aa
SHA256

156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673
SHA512

37acf3c7a0b52421b4b33b14e5707497cfc52e57322ad9ffac87d0551220afc202d4c0987460d295077b9ee681fac2021bbfdebdc52c829b5f998ce7ac2d1efe

Score

1^/10

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1100 wrote to memory of 2040	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 2040	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 2040	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 2040	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 2040	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 2040	1100	rundll32.exe	rundll32.exe
PID 1100 wrote to memory of 2040	1100	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1716	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1716	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1716	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1716	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1716	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1716	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1716	1344	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 740	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 740	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 740	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 740	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 740	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 740	1716	rundll32.exe	rundll32.exe
PID 1716 wrote to memory of 740	1716	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.bin.sample.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.bin.sample.dll,#1
2⤵
PID:2040

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.bin.sample.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.bin.sample.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.bin.sample.dll,#1
3⤵
PID:740

memory/740-64-0x0000000000000000-mapping.dmp

Download
memory/1716-62-0x0000000000000000-mapping.dmp

Download
memory/2040-61-0x0000000075B31000-0x0000000075B33000-memory.dmp

Filesize
8KB

Download
memory/2040-60-0x0000000000000000-mapping.dmp

Download