e192593ff1df7a3d24cc9463fdcde0b39b49a26816da608d50960da3131e2e36

Analysis

Target
Attachments_1.dll
Size 223KB
Sample211116-ng7e9adee7
SHA256 e192593ff1df7a3d24cc9463fdcde0b39b49a26816da608d50960da3131e2e36
MD5 869f280d62ffbc75bd140a75b01cf545
SHA1 bd224225099626d3af8e38915365f91f9f52d505
SHA512 e43a87e149d10afc43ad3127a23eff8ea0be2bb6104e355992a7c4949de1e2ce5a16ec1fae1ecf8ecbee238ab4803db3a5d8b0df934203c852a07d848307b85e
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 1164	3440	rundll32.exe	71
PID 3440 wrote to memory of 1164	3440	rundll32.exe	71
PID 1164 wrote to memory of 3148	1164	cmd.exe	73
PID 1164 wrote to memory of 3148	1164	cmd.exe	73
PID 1164 wrote to memory of 1888	1164	cmd.exe	74
PID 1164 wrote to memory of 1888	1164	cmd.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Attachments_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\system32\cmd.exe
  cmd /c choice /c y /d y /t 7 & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Attachments_1.dll", #1 YE4wU1wE UJzrG1wF & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\system32\choice.exe
    choice /c y /d y /t 7
    3⤵
    PID:3148
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Attachments_1.dll", #1 YE4wU1wE UJzrG1wF
    3⤵
    PID:1888

memory/1888-122-0x00000253BFFC0000-0x00000253BFFDF000-memory.dmp

Download

memory/3440-118-0x0000013772EA0000-0x0000013772EBF000-memory.dmp

Download