c4ee1c01c69af8c987dfc5f7790b3c8d2474ae1fe1771d4f2fef9720d54fd3ff

Analysis

Target
4925a10905e4df9d65e87afed2d77c45.dll
Size 794KB
Sample220120-p5sgnsaag2
SHA256 c4ee1c01c69af8c987dfc5f7790b3c8d2474ae1fe1771d4f2fef9720d54fd3ff
MD5 4925a10905e4df9d65e87afed2d77c45
SHA1 ef913fbd9ec848b59941bc8cce6e0a357d850b2d
SHA512 6f0b7ca987d6b4e6ddd90c8fe5cdf729fa37f0c0237effaa7f02623823253f58f0e17de0733ff408fa47be1f63d204c79c2d7bc4a2579e2adffb36bc7bf8b1cf
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 664	1892	rundll32.exe	29
PID 1892 wrote to memory of 664	1892	rundll32.exe	29
PID 1892 wrote to memory of 664	1892	rundll32.exe	29
PID 664 wrote to memory of 608	664	cmd.exe	31
PID 664 wrote to memory of 608	664	cmd.exe	31
PID 664 wrote to memory of 608	664	cmd.exe	31
PID 664 wrote to memory of 772	664	cmd.exe	32
PID 664 wrote to memory of 772	664	cmd.exe	32
PID 664 wrote to memory of 772	664	cmd.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4925a10905e4df9d65e87afed2d77c45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\system32\cmd.exe
  cmd /c choice /c y /d y /t 5 > NUL & "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\4925a10905e4df9d65e87afed2d77c45.dll", #1 wD6bUqfE kO5rG7fD & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Windows\system32\choice.exe
    choice /c y /d y /t 5
    3⤵
    PID:608
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\4925a10905e4df9d65e87afed2d77c45.dll", #1 wD6bUqfE kO5rG7fD
    3⤵
    PID:772

memory/772-58-0x0000000000150000-0x0000000000170000-memory.dmp

Download

memory/1892-54-0x00000000001C0000-0x00000000001E0000-memory.dmp

Download