44db4322412cfbbaaef431e3fa0691e8a1cbe2be666463d7d55809e839c223c6

Analysis

Target
44db4322412cfbbaaef431e3fa0691e8a1cbe2be666463d7d55809e839c223c6.dll
Size 252KB
Sample211116-l3crnaabdr
SHA256 44db4322412cfbbaaef431e3fa0691e8a1cbe2be666463d7d55809e839c223c6
MD5 8950e7e3f85b4d673f0c18fafc9acacd
SHA1 892b529ac4134828d2f7c64574223fa9fd931fde
SHA512 dc33f1f42f1b8d2cac3e3f839fcb3ef3bb24a906e75b41960f3303a226e2cfe3611005e7e5ee75a6ae4558beefa970cbecdcfe14990d48ce104adac699e5ec7d
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
18	2688	rundll32.exe
19	2688	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2688	rundll32.exe
2688	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2648	2456	rundll32.exe	68
PID 2456 wrote to memory of 2648	2456	rundll32.exe	68
PID 2456 wrote to memory of 2648	2456	rundll32.exe	68
PID 2648 wrote to memory of 2688	2648	rundll32.exe	69
PID 2648 wrote to memory of 2688	2648	rundll32.exe	69
PID 2648 wrote to memory of 2688	2648	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44db4322412cfbbaaef431e3fa0691e8a1cbe2be666463d7d55809e839c223c6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44db4322412cfbbaaef431e3fa0691e8a1cbe2be666463d7d55809e839c223c6.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\44db4322412cfbbaaef431e3fa0691e8a1cbe2be666463d7d55809e839c223c6.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2688

memory/2648-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download