e6111d8c3212aa9b0c9eeb3aa13cf4b2c0eb76d293c4e42b7e9cd7c49216a440

Analysis

Target
e6111d8c3212aa9b0c9eeb3aa13cf4b2c0eb76d293c4e42b7e9cd7c49216a440.dll
Size 252KB
Sample211116-l3ydcsdbg4
SHA256 e6111d8c3212aa9b0c9eeb3aa13cf4b2c0eb76d293c4e42b7e9cd7c49216a440
MD5 ab06787bfa4eb49f8eb7b8a5236d4dfd
SHA1 49175d058eec6195dc2228a5d149c2e1e253ed90
SHA512 7668344a9d70cd57f1c6848189d1602146c2d20fcd9e700f40f3f614890913b3f6870d8c2f4b080b0237d1281bb5db72cd5fb477c819734b083e8135ae066694
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
17	3824	rundll32.exe
18	3824	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3824	rundll32.exe
3824	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 3496	2476	rundll32.exe	68
PID 2476 wrote to memory of 3496	2476	rundll32.exe	68
PID 2476 wrote to memory of 3496	2476	rundll32.exe	68
PID 3496 wrote to memory of 3824	3496	rundll32.exe	69
PID 3496 wrote to memory of 3824	3496	rundll32.exe	69
PID 3496 wrote to memory of 3824	3496	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6111d8c3212aa9b0c9eeb3aa13cf4b2c0eb76d293c4e42b7e9cd7c49216a440.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6111d8c3212aa9b0c9eeb3aa13cf4b2c0eb76d293c4e42b7e9cd7c49216a440.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\e6111d8c3212aa9b0c9eeb3aa13cf4b2c0eb76d293c4e42b7e9cd7c49216a440.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3824

memory/3496-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download