0c2e254376127f76d44fc9276000697e45a2977fca4384705e84994ab63fdc37

Analysis

Target

0c2e254376127f76d44fc9276000697e45a2977fca4384705e84994ab63fdc37.dll
Size

115KB
MD5

abcecad6ec78064bf7de52f3cda8e604
SHA1

b4a00d993b9354a8f337600999eeb578b0065de2
SHA256

0c2e254376127f76d44fc9276000697e45a2977fca4384705e84994ab63fdc37
SHA512

cde2f88377073e7b579a0005abea7207c5048026fcb245e538607db17509ffb891eef136018e810cd7705b0985b76be235f9a6387270e111d003e40fb98f8c4d

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4416	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3784	rundll32.exe
3784	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 4228	3784	rundll32.exe	68
PID 3784 wrote to memory of 4228	3784	rundll32.exe	68
PID 4228 wrote to memory of 4416	4228	cmd.exe	70
PID 4228 wrote to memory of 4416	4228	cmd.exe	70
PID 4228 wrote to memory of 4488	4228	cmd.exe	71
PID 4228 wrote to memory of 4488	4228	cmd.exe	71

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact