b00b0a31d4f9c373d720daa53bedfe7cf57cf4827fa58465cf60923913fc1bb6

Analysis

Target
b00b0a.dll
Size 348KB
Sample220304-rt6ahagefm
SHA256 b00b0a31d4f9c373d720daa53bedfe7cf57cf4827fa58465cf60923913fc1bb6
MD5 535808cac3ad2ec6438ea4b2e8704bf6
SHA1 ce60ea865d7f05f290f732725608af87cf5c36cb
SHA512 a1b7baa92b3ba12ef4d7aace146bd5da0aab3378d3d76a31214f39d2e8154324c8abb6695110bf66cf8ae6c64407443f4e801d904b66cab85fa9a0bc8a97a464
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 5 IoCs

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 180 wrote to memory of 3604	180	rundll32.exe	58
PID 180 wrote to memory of 3604	180	rundll32.exe	58
PID 180 wrote to memory of 3604	180	rundll32.exe	58

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b00b0a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b00b0a.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3604

memory/3604-130-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/3604-131-0x0000000010000000-0x000000001005C000-memory.dmp

Download