b75c337a0fb7eb49ec34d6d313a612e93dc4180a8bf25f99fd7b10ea1077e8e1

Analysis

Target
macosx.dll
Size 263KB
Sample211229-btke2adabl
SHA256 b75c337a0fb7eb49ec34d6d313a612e93dc4180a8bf25f99fd7b10ea1077e8e1
MD5 a3644b79bb1ce2fe044fb4ad8dea13d0
SHA1 1d460c0f5a69be50f76f0fbc022ffd2d24213deb
SHA512 60cc1e7119e04b43fa46fab915ddc7fdd84645e45dde94e47b4a079da1e0c65a9099ced7a86a5f83a505522a4bae17c6aa190aaba797112f70ae24db8bd81dbe
MD5 SHA1 SHA512

Score

1^/10

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1396	timeout.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1032	1972	rundll32.exe	29
PID 1972 wrote to memory of 1032	1972	rundll32.exe	29
PID 1972 wrote to memory of 1032	1972	rundll32.exe	29
PID 1032 wrote to memory of 1396	1032	cmd.exe	31
PID 1032 wrote to memory of 1396	1032	cmd.exe	31
PID 1032 wrote to memory of 1396	1032	cmd.exe	31
PID 1032 wrote to memory of 1436	1032	cmd.exe	32
PID 1032 wrote to memory of 1436	1032	cmd.exe	32
PID 1032 wrote to memory of 1436	1032	cmd.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\macosx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\cmd.exe
  cmd /c timeout /t 5 /nobreak > NUL & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\macosx.dll", #1 wD6bUqfE kO5rG7fD & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1396
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\macosx.dll", #1 wD6bUqfE kO5rG7fD
    3⤵
    PID:1436

memory/1972-55-0x0000000180000000-0x0000000180020000-memory.dmp

Download