01cc4b3f843e4dcc6ee370afefadfc483e212c73d0d22811e72e5b3e813e4b8d

Analysis

Target

01cc4b3f843e4dcc6ee370afefadfc483e212c73d0d22811e72e5b3e813e4b8d.dll
Size

164KB
MD5

8941ca57999f7f1b486951806cc0f9af
SHA1

2e9233ec9ef70b7101749281efd14881f0a95f32
SHA256

01cc4b3f843e4dcc6ee370afefadfc483e212c73d0d22811e72e5b3e813e4b8d
SHA512

7520e0a053abf1b23f746da81d19ab6bdfaa14f580be803386f6449745ce1971be50416f5d8d3ff8620a0a7cee7501fefb90307e28749e00346f3a4561db77c6

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1748 rundll32.exe

pid	process
1748	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 804 wrote to memory of 1748	804	rundll32.exe	rundll32.exe
PID 804 wrote to memory of 1748	804	rundll32.exe	rundll32.exe
PID 804 wrote to memory of 1748	804	rundll32.exe	rundll32.exe
PID 804 wrote to memory of 1748	804	rundll32.exe	rundll32.exe
PID 804 wrote to memory of 1748	804	rundll32.exe	rundll32.exe
PID 804 wrote to memory of 1748	804	rundll32.exe	rundll32.exe
PID 804 wrote to memory of 1748	804	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01cc4b3f843e4dcc6ee370afefadfc483e212c73d0d22811e72e5b3e813e4b8d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01cc4b3f843e4dcc6ee370afefadfc483e212c73d0d22811e72e5b3e813e4b8d.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748

memory/1748-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1748-57-0x00000000000C0000-0x00000000000CA000-memory.dmp

Filesize
40KB

Download
memory/1748-58-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1748-59-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1748-60-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1748-56-0x0000000002000000-0x00000000020C9000-memory.dmp

Filesize
804KB

Download
memory/1748-62-0x00000000023D0000-0x00000000024FD000-memory.dmp

Filesize
1.2MB

Download
memory/1748-63-0x0000000000370000-0x000000000038F000-memory.dmp

Filesize
124KB

Download
memory/1748-64-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/1748-65-0x0000000003450000-0x0000000003559000-memory.dmp

Filesize
1.0MB

Download