a06010d09b93b8cf46c397a30a15e7f4a163fddd7eaa18dc0eeb202b9f2560a5

Analysis

Target
macosx.dll
Size 264KB
Sample211229-bszhkaedd3
SHA256 a06010d09b93b8cf46c397a30a15e7f4a163fddd7eaa18dc0eeb202b9f2560a5
MD5 a18616c093295d038bb8b9762be3d682
SHA1 6911e8335613498dc10f7cc209c544882d17ff90
SHA512 79fc6cc0df51a7c9dd2da0517ed887a5e8b9e0dddf3e910d13c3b5ebc423baa62df26dd0bcab19c13651db922c17db5182f9e41045724358c7a1ef379199bf03
MD5 SHA1 SHA512

Score

1^/10

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4296	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 4408	1672	rundll32.exe	71
PID 1672 wrote to memory of 4408	1672	rundll32.exe	71
PID 4408 wrote to memory of 4296	4408	cmd.exe	73
PID 4408 wrote to memory of 4296	4408	cmd.exe	73
PID 4408 wrote to memory of 3276	4408	cmd.exe	74
PID 4408 wrote to memory of 3276	4408	cmd.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\macosx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\cmd.exe
  cmd /c timeout 9 /nobreak & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\macosx.dll", #1 YE4wU1wE UJzrG1wF & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\system32\timeout.exe
    timeout 9 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4296
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\macosx.dll", #1 YE4wU1wE UJzrG1wF
    3⤵
    PID:3276

memory/1672-116-0x0000000180000000-0x0000000180020000-memory.dmp

Download