8050946d45275d1d9a207b61e1e7c69f906193fe120b111497bb15960f9ca379

Analysis

Target

libwinpthread-1.dll
Size

69KB
MD5

1e0d62c34ff2e649ebc5c372065732ee
SHA1

fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256

509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA512

3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1948 wrote to memory of 1864	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1864	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1864	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1864	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1864	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1864	1948	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 1864	1948	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll,#1
2⤵
PID:1864

memory/1864-59-0x0000000000000000-mapping.dmp

Download
memory/1864-60-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/1864-62-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1864-61-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1864-63-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1864-64-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download