7c964794e19b093b78a81da3b8dcafbe3d32153a044c19f6892829ed9ff71f46

Analysis

Target
11.xll.dll
Size 38KB
Sample211115-twc3vafggq
SHA256 7c964794e19b093b78a81da3b8dcafbe3d32153a044c19f6892829ed9ff71f46
MD5 85ae2d7cd0c312f7fb0c1eeab79f19cf
SHA1 b149e68a48d1fd16d3dd563bd1517f8b031b31c4
SHA512 79b9f12420e39e2e2e7084ab0ae23f91c3557cb8c836c403443f4560e195cd33fe2263a6063f6cd9846ee37b78c377065ed55ccd48aee835a2d08897573f0bdb
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
13	3288	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
488	service.eXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3288	2276	rundll32.exe	69
PID 2276 wrote to memory of 3288	2276	rundll32.exe	69
PID 2276 wrote to memory of 3288	2276	rundll32.exe	69
PID 3288 wrote to memory of 488	3288	rundll32.exe	70
PID 3288 wrote to memory of 488	3288	rundll32.exe	70
PID 3288 wrote to memory of 488	3288	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11.xll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11.xll.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\ProgramData\service.eXE
    "C:\ProgramData\service.eXE"
    3⤵
    - Executes dropped EXE
    PID:488