0c2e254376127f76d44fc9276000697e45a2977fca4384705e84994ab63fdc37

Analysis

Target

0c2e254376127f76d44fc9276000697e45a2977fca4384705e84994ab63fdc37.dll
Size

115KB
MD5

abcecad6ec78064bf7de52f3cda8e604
SHA1

b4a00d993b9354a8f337600999eeb578b0065de2
SHA256

0c2e254376127f76d44fc9276000697e45a2977fca4384705e84994ab63fdc37
SHA512

cde2f88377073e7b579a0005abea7207c5048026fcb245e538607db17509ffb891eef136018e810cd7705b0985b76be235f9a6387270e111d003e40fb98f8c4d

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1628 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2004 rundll32.exe

pid	process
1628	PING.EXE

pid	process
2004	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

rundll32.execmd.exe

description	pid	process	target process
PID 2004 wrote to memory of 612	2004	rundll32.exe	cmd.exe
PID 2004 wrote to memory of 612	2004	rundll32.exe	cmd.exe
PID 2004 wrote to memory of 612	2004	rundll32.exe	cmd.exe
PID 612 wrote to memory of 1628	612	cmd.exe	PING.EXE
PID 612 wrote to memory of 1628	612	cmd.exe	PING.EXE
PID 612 wrote to memory of 1628	612	cmd.exe	PING.EXE
PID 612 wrote to memory of 1736	612	cmd.exe	rundll32.exe
PID 612 wrote to memory of 1736	612	cmd.exe	rundll32.exe
PID 612 wrote to memory of 1736	612	cmd.exe	rundll32.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact