22e899eddfcdd250f184f10d71b117c2b6a1625847ba5c46c39ee6245afc1ef2

Analysis

Target
0301adf4281ae21a9c6628877c094dc7.dll
Size 244KB
Sample211116-ze99xafdf2
SHA256 22e899eddfcdd250f184f10d71b117c2b6a1625847ba5c46c39ee6245afc1ef2
MD5 0301adf4281ae21a9c6628877c094dc7
SHA1 0454d41b7bb44b735a5f55913fdd981d18886ff0
SHA512 d6c03efc54d735e3e0e25f5334d14e641791175c4e390100e6a3be4198d7bcfc4d469c020a9c6004b755b5f14741f91002e4dbfa4c615400bb5b8d0077e30f79
MD5 SHA1 SHA512

Score

1^/10

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2584	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 924	2176	rundll32.exe	71
PID 2176 wrote to memory of 924	2176	rundll32.exe	71
PID 924 wrote to memory of 2584	924	cmd.exe	73
PID 924 wrote to memory of 2584	924	cmd.exe	73
PID 924 wrote to memory of 1616	924	cmd.exe	74
PID 924 wrote to memory of 1616	924	cmd.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0301adf4281ae21a9c6628877c094dc7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\system32\cmd.exe
  cmd /c timeout 5 /nobreak > NUL & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\0301adf4281ae21a9c6628877c094dc7.dll", #1 YE4wU1wE UJzrG1wF & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\system32\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2584
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\0301adf4281ae21a9c6628877c094dc7.dll", #1 YE4wU1wE UJzrG1wF
    3⤵
    PID:1616

memory/1616-122-0x000001E33BE80000-0x000001E33BE9F000-memory.dmp

Download

memory/2176-118-0x000002AEC70E0000-0x000002AEC70FF000-memory.dmp

Download