8f22dd0a473e1ec0d3d9e74f715560829f09d0d835f4106c1bdb750f9956f886

Analysis

Target

8f22dd0a473e1ec0d3d9e74f715560829f09d0d835f4106c1bdb750f9956f886.dll
Size

98KB
MD5

0578982754386d6e3ea42de36e198571
SHA1

d90d831dfd2e25269befad8a7d26266b04e7f9ec
SHA256

8f22dd0a473e1ec0d3d9e74f715560829f09d0d835f4106c1bdb750f9956f886
SHA512

95cee4f6944b5460295c037098482b91866b61de05f5b369090eeddc8d9373a659437411237f94a18a3952f6e6181d3171c04e2f18a7a98395e4259321d089d0

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2924 wrote to memory of 940	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 940	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 940	2924	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 696	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 696	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 696	940	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f22dd0a473e1ec0d3d9e74f715560829f09d0d835f4106c1bdb750f9956f886.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f22dd0a473e1ec0d3d9e74f715560829f09d0d835f4106c1bdb750f9956f886.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\SysWOW64\rundll32.exe
    --9dfb4f4a
    3⤵
    PID:696