ab2a474c3fd276095d7db5d78df356a572b1eee397ef1977facd8df214db3db0

Analysis

Target

ab2a474c3fd276095d7db5d78df356a572b1eee397ef1977facd8df214db3db0.dll
Size

20KB
MD5

a2dd642315f3cc6b44241c31ec964ea3
SHA1

6a2426de100f63c884a54ed12013e3094e6fe10b
SHA256

ab2a474c3fd276095d7db5d78df356a572b1eee397ef1977facd8df214db3db0
SHA512

843e056ea08680540f2338c2c73e71777e9b395273bb56480f121d2074f1bb7957f798c198bd1840b2fc2b74a756a6c7be621ee545e2aab3f1212f176d7f5bae

Score

8^/10

Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

7 2136 rundll32.exe
12 2136 rundll32.exe
41 2136 rundll32.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 api.ipify.org
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

2136 rundll32.exe
2136 rundll32.exe
2136 rundll32.exe
2136 rundll32.exe

flow	ioc
6	api.ipify.org

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5100 wrote to memory of 2136	5100	rundll32.exe	rundll32.exe
PID 5100 wrote to memory of 2136	5100	rundll32.exe	rundll32.exe
PID 5100 wrote to memory of 2136	5100	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab2a474c3fd276095d7db5d78df356a572b1eee397ef1977facd8df214db3db0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100