567467481d2b8ba48de0a37027565565b19d5dba92a5e4ecc58a5ef1dc9adc3f

Analysis

Target
dda26e948ec448cdbe43228b63ad9b13.dll
Size 252KB
Sample211116-afgasaggdj
SHA256 567467481d2b8ba48de0a37027565565b19d5dba92a5e4ecc58a5ef1dc9adc3f
MD5 dda26e948ec448cdbe43228b63ad9b13
SHA1 1c81164e6f21745739d81424a6336fd2bfeedf1f
SHA512 38128ec1e7834cf34db2890e225ddda228fdf48005da3e3e6361a18728775672035cad43c37fb5de190c8285a977d2b386918155d3f9149bdce4eaf58f1b1b7e
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
16	2820	rundll32.exe
17	2820	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2820	rundll32.exe
2820	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 2124	4044	rundll32.exe	68
PID 4044 wrote to memory of 2124	4044	rundll32.exe	68
PID 4044 wrote to memory of 2124	4044	rundll32.exe	68
PID 2124 wrote to memory of 2820	2124	rundll32.exe	69
PID 2124 wrote to memory of 2820	2124	rundll32.exe	69
PID 2124 wrote to memory of 2820	2124	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dda26e948ec448cdbe43228b63ad9b13.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dda26e948ec448cdbe43228b63ad9b13.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\dda26e948ec448cdbe43228b63ad9b13.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2820

memory/2124-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download