2785d55eb80682a1ec4aea657bb7448a76f0401c4cfa2bdf27654ff8c586b69c

Analysis

Target
2785d55eb80682a1ec4aea657bb7448a76f0401c4cfa2bdf27654ff8c586b69c.dll
Size 252KB
Sample211116-l3ydcsdbg6
SHA256 2785d55eb80682a1ec4aea657bb7448a76f0401c4cfa2bdf27654ff8c586b69c
MD5 70ba1a016fd62aea8fbfa22927f640ad
SHA1 3c5e4b3c4c5ea47dd742d434d78d36133e3757c2
SHA512 85a7ca5b361213f0b072e51c4247b74ff29dd846eafef05635889b79ada9bf5fab2b07c38d893024b976d32264c76d725d8ff555b7038c51c90473450cac15f1
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
17	3780	rundll32.exe
18	3780	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3780	rundll32.exe
3780	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2708	2700	rundll32.exe	68
PID 2700 wrote to memory of 2708	2700	rundll32.exe	68
PID 2700 wrote to memory of 2708	2700	rundll32.exe	68
PID 2708 wrote to memory of 3780	2708	rundll32.exe	69
PID 2708 wrote to memory of 3780	2708	rundll32.exe	69
PID 2708 wrote to memory of 3780	2708	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2785d55eb80682a1ec4aea657bb7448a76f0401c4cfa2bdf27654ff8c586b69c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2785d55eb80682a1ec4aea657bb7448a76f0401c4cfa2bdf27654ff8c586b69c.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2785d55eb80682a1ec4aea657bb7448a76f0401c4cfa2bdf27654ff8c586b69c.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3780

memory/2708-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download