ee6f18b59330b042ffdc1ce5a9e35eec5ac8dd403bbdb2f883ae45bc48e23d67

Analysis

Target
350d473becbeec99c9224e66e842a305.dll
Size 252KB
Sample211116-af279aggdn
SHA256 ee6f18b59330b042ffdc1ce5a9e35eec5ac8dd403bbdb2f883ae45bc48e23d67
MD5 350d473becbeec99c9224e66e842a305
SHA1 80ec820b93e185f55f0853819316cfcdea09432e
SHA512 618d99d74e747b73395fddcc3224f3dc67fcb1bb56e24d8fd6f5ebd0f69d76b132758146294436dc094b7a0924356dfd73a37f6a4f4c2d9836ad766db1399e0d
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	432	rundll32.exe
6	432	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
432	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1908	856	rundll32.exe	27
PID 856 wrote to memory of 1908	856	rundll32.exe	27
PID 856 wrote to memory of 1908	856	rundll32.exe	27
PID 856 wrote to memory of 1908	856	rundll32.exe	27
PID 856 wrote to memory of 1908	856	rundll32.exe	27
PID 856 wrote to memory of 1908	856	rundll32.exe	27
PID 856 wrote to memory of 1908	856	rundll32.exe	27
PID 1908 wrote to memory of 432	1908	rundll32.exe	29
PID 1908 wrote to memory of 432	1908	rundll32.exe	29
PID 1908 wrote to memory of 432	1908	rundll32.exe	29
PID 1908 wrote to memory of 432	1908	rundll32.exe	29
PID 1908 wrote to memory of 432	1908	rundll32.exe	29
PID 1908 wrote to memory of 432	1908	rundll32.exe	29
PID 1908 wrote to memory of 432	1908	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\350d473becbeec99c9224e66e842a305.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\350d473becbeec99c9224e66e842a305.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\350d473becbeec99c9224e66e842a305.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:432

memory/1908-56-0x0000000074F01000-0x0000000074F03000-memory.dmp

Download

memory/1908-59-0x0000000010000000-0x0000000010028000-memory.dmp

Download