b2bdb89e7f66ff7bb2bc784e511346f9e0437fa0db0a22f3413283bedc610933

Analysis

Target

b2bdb89e7f66ff7bb2bc784e511346f9e0437fa0db0a22f3413283bedc610933.dll
Size

164KB
MD5

c27bbe2a8ae596a72ddffb87649bf472
SHA1

0e5da9ec26b764caf2f54bc99967346ab47f7e9f
SHA256

b2bdb89e7f66ff7bb2bc784e511346f9e0437fa0db0a22f3413283bedc610933
SHA512

4b4b09f8d30462e4dfebb95e710dd1016633b985b87b9ba5b02cfb445c0a4d72729764a4d6224c9606647840710c9facdcfa777c6007f89ae26848fa50c8c5a2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1312 wrote to memory of 1572	1312	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 1572	1312	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 1572	1312	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 1572	1312	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 1572	1312	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 1572	1312	rundll32.exe	rundll32.exe
PID 1312 wrote to memory of 1572	1312	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2bdb89e7f66ff7bb2bc784e511346f9e0437fa0db0a22f3413283bedc610933.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2bdb89e7f66ff7bb2bc784e511346f9e0437fa0db0a22f3413283bedc610933.dll,#1
2⤵
PID:1572

memory/1572-54-0x0000000076911000-0x0000000076913000-memory.dmp

Filesize
8KB

Download
memory/1572-57-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/1572-58-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1572-59-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1572-60-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1572-63-0x0000000002FC0000-0x00000000030ED000-memory.dmp

Filesize
1.2MB

Download
memory/1572-64-0x00000000008D0000-0x00000000008EF000-memory.dmp

Filesize
124KB

Download
memory/1572-65-0x0000000003430000-0x0000000003539000-memory.dmp

Filesize
1.0MB

Download
memory/1572-66-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download