0c2e254376127f76d44fc9276000697e45a2977fca4384705e84994ab63fdc37

Analysis

Target

0c2e254376127f76d44fc9276000697e45a2977fca4384705e84994ab63fdc37.dll
Size

115KB
MD5

abcecad6ec78064bf7de52f3cda8e604
SHA1

b4a00d993b9354a8f337600999eeb578b0065de2
SHA256

0c2e254376127f76d44fc9276000697e45a2977fca4384705e84994ab63fdc37
SHA512

cde2f88377073e7b579a0005abea7207c5048026fcb245e538607db17509ffb891eef136018e810cd7705b0985b76be235f9a6387270e111d003e40fb98f8c4d

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4416 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3784 rundll32.exe
3784 rundll32.exe

pid	process
4416	PING.EXE

pid	process
3784	rundll32.exe
3784	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.execmd.exe

description	pid	process	target process
PID 3784 wrote to memory of 4228	3784	rundll32.exe	cmd.exe
PID 3784 wrote to memory of 4228	3784	rundll32.exe	cmd.exe
PID 4228 wrote to memory of 4416	4228	cmd.exe	PING.EXE
PID 4228 wrote to memory of 4416	4228	cmd.exe	PING.EXE
PID 4228 wrote to memory of 4488	4228	cmd.exe	rundll32.exe
PID 4228 wrote to memory of 4488	4228	cmd.exe	rundll32.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact