c765e040e1facf4b651d4684a4fdb3fd04c0d01e506bfb0dce454104f2c43f8c

Analysis

Target
macosx.dll
Size 263KB
Sample211229-btke2adaaq
SHA256 c765e040e1facf4b651d4684a4fdb3fd04c0d01e506bfb0dce454104f2c43f8c
MD5 49c7cc20333951bb7520c6ecabef85de
SHA1 984d3443e5119ddf2e45001404694e59cb92f0df
SHA512 c91aac84f47eacfbcab160a3d0640fac24eccbd0f612670b88c1c63e6c6b16d72e800fbe1422a625b8657fad6db51a8e9e0a3555233020ef16642f2264d4c23a
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 876	968	rundll32.exe	29
PID 968 wrote to memory of 876	968	rundll32.exe	29
PID 968 wrote to memory of 876	968	rundll32.exe	29
PID 876 wrote to memory of 740	876	cmd.exe	31
PID 876 wrote to memory of 740	876	cmd.exe	31
PID 876 wrote to memory of 740	876	cmd.exe	31
PID 876 wrote to memory of 432	876	cmd.exe	32
PID 876 wrote to memory of 432	876	cmd.exe	32
PID 876 wrote to memory of 432	876	cmd.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\macosx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\system32\cmd.exe
  cmd /c choice /n /c y /d y /t 7 > NUL & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\macosx.dll", #1 wD6bUqfE kO5rG7fD & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\system32\choice.exe
    choice /n /c y /d y /t 7
    3⤵
    PID:740
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\macosx.dll", #1 wD6bUqfE kO5rG7fD
    3⤵
    PID:432

memory/968-53-0x0000000180000000-0x0000000180020000-memory.dmp

Download