b75c337a0fb7eb49ec34d6d313a612e93dc4180a8bf25f99fd7b10ea1077e8e1

Analysis

Target
macosx.dll
Size 263KB
Sample211229-btke2adabl
SHA256 b75c337a0fb7eb49ec34d6d313a612e93dc4180a8bf25f99fd7b10ea1077e8e1
MD5 a3644b79bb1ce2fe044fb4ad8dea13d0
SHA1 1d460c0f5a69be50f76f0fbc022ffd2d24213deb
SHA512 60cc1e7119e04b43fa46fab915ddc7fdd84645e45dde94e47b4a079da1e0c65a9099ced7a86a5f83a505522a4bae17c6aa190aaba797112f70ae24db8bd81dbe
MD5 SHA1 SHA512

Score

1^/10

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1940	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 1216	3116	rundll32.exe	71
PID 3116 wrote to memory of 1216	3116	rundll32.exe	71
PID 1216 wrote to memory of 1940	1216	cmd.exe	73
PID 1216 wrote to memory of 1940	1216	cmd.exe	73
PID 1216 wrote to memory of 2536	1216	cmd.exe	74
PID 1216 wrote to memory of 2536	1216	cmd.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\macosx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\system32\cmd.exe
  cmd /c timeout 7 /nobreak & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\macosx.dll", #1 YE4wU1wE UJzrG1wF & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\system32\timeout.exe
    timeout 7 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1940
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\macosx.dll", #1 YE4wU1wE UJzrG1wF
    3⤵
    PID:2536

memory/3116-115-0x0000000180000000-0x0000000180020000-memory.dmp

Download