bb12dc21e8647eba9a7a99b1112f1ab729571ca28ac46f3c7edb533574a5de4f

Analysis

Target
bb12dc21e8647eba9a7a99b1112f1ab729571ca28ac46f3c7edb533574a5de4f.bin.dll
Size 26KB
Sample210906-nb12aaebcq
SHA256 bb12dc21e8647eba9a7a99b1112f1ab729571ca28ac46f3c7edb533574a5de4f
MD5 f56b470f0f5518709633494dbff2c26d
SHA1 e8172f96276c735c672557cc140143cd5b403fca
SHA512 a0bfee31c760626406cc4c4bf81dac4f5492370df9bd4a3990a2cabce30e48e09a360cad29079e36d414ed5efa3dd772836c164802ecadda2d768e714847d85d
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 4 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1956	1080	rundll32.exe	26
PID 1080 wrote to memory of 1956	1080	rundll32.exe	26
PID 1080 wrote to memory of 1956	1080	rundll32.exe	26
PID 1080 wrote to memory of 1956	1080	rundll32.exe	26
PID 1080 wrote to memory of 1956	1080	rundll32.exe	26
PID 1080 wrote to memory of 1956	1080	rundll32.exe	26
PID 1080 wrote to memory of 1956	1080	rundll32.exe	26
PID 1956 wrote to memory of 1728	1956	rundll32.exe	27
PID 1956 wrote to memory of 1728	1956	rundll32.exe	27
PID 1956 wrote to memory of 1728	1956	rundll32.exe	27
PID 1956 wrote to memory of 1728	1956	rundll32.exe	27
PID 1956 wrote to memory of 1728	1956	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb12dc21e8647eba9a7a99b1112f1ab729571ca28ac46f3c7edb533574a5de4f.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb12dc21e8647eba9a7a99b1112f1ab729571ca28ac46f3c7edb533574a5de4f.bin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Blocklisted process makes network request
    PID:1728

memory/1728-57-0x0000000000080000-0x0000000000083000-memory.dmp

Download

memory/1728-58-0x0000000000180000-0x0000000000187000-memory.dmp

Download

memory/1956-54-0x0000000075991000-0x0000000075993000-memory.dmp

Download