ee6f18b59330b042ffdc1ce5a9e35eec5ac8dd403bbdb2f883ae45bc48e23d67

Analysis

Target
350d473becbeec99c9224e66e842a305.dll
Size 252KB
Sample211116-af279aggdn
SHA256 ee6f18b59330b042ffdc1ce5a9e35eec5ac8dd403bbdb2f883ae45bc48e23d67
MD5 350d473becbeec99c9224e66e842a305
SHA1 80ec820b93e185f55f0853819316cfcdea09432e
SHA512 618d99d74e747b73395fddcc3224f3dc67fcb1bb56e24d8fd6f5ebd0f69d76b132758146294436dc094b7a0924356dfd73a37f6a4f4c2d9836ad766db1399e0d
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	2704	rundll32.exe
11	2704	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2704	rundll32.exe
2704	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3488	3020	rundll32.exe	68
PID 3020 wrote to memory of 3488	3020	rundll32.exe	68
PID 3020 wrote to memory of 3488	3020	rundll32.exe	68
PID 3488 wrote to memory of 2704	3488	rundll32.exe	69
PID 3488 wrote to memory of 2704	3488	rundll32.exe	69
PID 3488 wrote to memory of 2704	3488	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\350d473becbeec99c9224e66e842a305.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\350d473becbeec99c9224e66e842a305.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\350d473becbeec99c9224e66e842a305.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2704

memory/3488-117-0x0000000010000000-0x0000000010028000-memory.dmp

Download