77aefbe35bd7ea9b4f461084655bf7b870f07d4425d4619e781522edba3d248b

Analysis

Target

77aefbe35bd7ea9b4f461084655bf7b870f07d4425d4619e781522edba3d248b.dll
Size

164KB
MD5

abfba91a82b5a23af15c70c0d970c51d
SHA1

c7f8ab5c08c14ff16e0fe1fb467e44f760c51134
SHA256

77aefbe35bd7ea9b4f461084655bf7b870f07d4425d4619e781522edba3d248b
SHA512

b622b8e9518141d226e417f71ef892a11e1e8fd1c6a513376ef8e4b0609038e4a0aff447ed0602f9500a5c3f10458cb99a54372ed59fbeeb746695fffa16bd00

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1796 wrote to memory of 1936	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1936	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1936	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1936	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1936	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1936	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1936	1796	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77aefbe35bd7ea9b4f461084655bf7b870f07d4425d4619e781522edba3d248b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77aefbe35bd7ea9b4f461084655bf7b870f07d4425d4619e781522edba3d248b.dll,#1
2⤵
PID:1936

memory/1936-55-0x0000000076511000-0x0000000076513000-memory.dmp

Filesize
8KB

Download
memory/1936-57-0x0000000000D3A000-0x0000000000D51000-memory.dmp

Filesize
92KB

Download
memory/1936-58-0x0000000002470000-0x000000000259D000-memory.dmp

Filesize
1.2MB

Download
memory/1936-59-0x0000000000810000-0x000000000082F000-memory.dmp

Filesize
124KB

Download
memory/1936-61-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/1936-62-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1936-63-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1936-65-0x0000000000690000-0x0000000000696000-memory.dmp

Filesize
24KB

Download
memory/1936-64-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1936-60-0x0000000002740000-0x0000000002849000-memory.dmp

Filesize
1.0MB

Download