30f68d167e174241a0ba25c4ee1aa1dd46dc4758915b67f2568eb6a61ba5a3d7

Analysis

Target
macosx.dll
Size 263KB
Sample211229-bszhkaedd5
SHA256 30f68d167e174241a0ba25c4ee1aa1dd46dc4758915b67f2568eb6a61ba5a3d7
MD5 e29be38b79554cd7d9826f4903723c09
SHA1 ab32487a899d3a82a5e7547408ebd666913336a1
SHA512 604a71aea41a3c8973bd41c25795ac0934db4dd5b5e5822bb640b77ee14fff8331f434084c98cbda2307fde0555c4054519e150a890e7a2e22704011682c9abd
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4328	3620	rundll32.exe	69
PID 3620 wrote to memory of 4328	3620	rundll32.exe	69
PID 4328 wrote to memory of 760	4328	cmd.exe	71
PID 4328 wrote to memory of 760	4328	cmd.exe	71
PID 4328 wrote to memory of 1956	4328	cmd.exe	74
PID 4328 wrote to memory of 1956	4328	cmd.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\macosx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\system32\cmd.exe
  cmd /c choice /n /c y /d y /t 7 > NUL & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\macosx.dll", #1 YE4wU1wE UJzrG1wF & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\system32\choice.exe
    choice /n /c y /d y /t 7
    3⤵
    PID:760
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\macosx.dll", #1 YE4wU1wE UJzrG1wF
    3⤵
    PID:1956

memory/3620-115-0x0000000180000000-0x0000000180020000-memory.dmp

Download