2a2b204b3d8df0388dd42a8fa5b7e9652f262c15b92de6ff13fec8778a6aac3f

Resubmissions

17/11/2021, 05:30

17/11/2021, 05:29

16/11/2021, 11:23

Target
Attachments_3.dll
Size 262KB
Sample211116-ng7e9aaecl
SHA256 2a2b204b3d8df0388dd42a8fa5b7e9652f262c15b92de6ff13fec8778a6aac3f
MD5 97ec93d30f45f24c0cdaf37f63a40901
SHA1 1e2cd7d64c7173de342fae824b1bddb61bee4770
SHA512 52f0652d599f6a415ca7a9631f2296497e140b42d1323bd0c239ed87a5bea3ce1550faf2a882b4c4dd8c933c719cd3b1cd728fa191b255259e36342b292fe31b
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3648	2748	rundll32.exe	71
PID 2748 wrote to memory of 3648	2748	rundll32.exe	71
PID 3648 wrote to memory of 2808	3648	cmd.exe	73
PID 3648 wrote to memory of 2808	3648	cmd.exe	73
PID 3648 wrote to memory of 2812	3648	cmd.exe	74
PID 3648 wrote to memory of 2812	3648	cmd.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Attachments_3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\system32\cmd.exe
  cmd /c choice /c y /d y /t 7 > NUL & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Attachments_3.dll", #1 YE4wU1wE UJzrG1wF & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\system32\choice.exe
    choice /c y /d y /t 7
    3⤵
    PID:2808
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Attachments_3.dll", #1 YE4wU1wE UJzrG1wF
    3⤵
    PID:2812

memory/2748-115-0x000001D924000000-0x000001D92401F000-memory.dmp

Download

memory/2812-119-0x00000243FF400000-0x00000243FF41F000-memory.dmp

Download