c53fa5f8345c7e15220f445f5babe995d7f49d8319fe99c5ebca4dc0b6d3c03a

Analysis

Target

c53fa5f8345c7e15220f445f5babe995d7f49d8319fe99c5ebca4dc0b6d3c03a.dll
Size

164KB
MD5

34c7caf74e06c60991d41df99ff387f4
SHA1

6a1ce2234360cc4d55100905581ef5370589498c
SHA256

c53fa5f8345c7e15220f445f5babe995d7f49d8319fe99c5ebca4dc0b6d3c03a
SHA512

85fa9b7ccafb2731777eab4f323f29920208e21de4630031f5d4e8c9bc9287254d1cf4af4662344ff15277dd44fb8d131469909d6de4352fda72638c2f6b4350

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1212 wrote to memory of 652	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 652	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 652	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 652	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 652	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 652	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 652	1212	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c53fa5f8345c7e15220f445f5babe995d7f49d8319fe99c5ebca4dc0b6d3c03a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c53fa5f8345c7e15220f445f5babe995d7f49d8319fe99c5ebca4dc0b6d3c03a.dll,#1
2⤵
PID:652

memory/652-54-0x0000000076001000-0x0000000076003000-memory.dmp

Filesize
8KB

Download
memory/652-56-0x00000000001F0000-0x00000000001FA000-memory.dmp

Filesize
40KB

Download
memory/652-57-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/652-58-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/652-59-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/652-55-0x0000000002110000-0x00000000021D9000-memory.dmp

Filesize
804KB

Download
memory/652-60-0x0000000000CDA000-0x0000000000CF1000-memory.dmp

Filesize
92KB

Download
memory/652-61-0x00000000023D0000-0x00000000024FD000-memory.dmp

Filesize
1.2MB

Download
memory/652-62-0x0000000000710000-0x000000000072F000-memory.dmp

Filesize
124KB

Download
memory/652-64-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/652-63-0x0000000003130000-0x0000000003239000-memory.dmp

Filesize
1.0MB

Download