c93e3ebcef2a7cfe6fb8ee28f05920e94ebdce5a9ec331a09b082b76f7faa7ce

Analysis

Target

c93e3ebcef2a7cfe6fb8ee28f05920e94ebdce5a9ec331a09b082b76f7faa7ce.dll
Size

172KB
MD5

74751d36c849943a9244125d7050e94e
SHA1

d6e5e910f4c1c9d4693a3822b6169ee3f6934287
SHA256

c93e3ebcef2a7cfe6fb8ee28f05920e94ebdce5a9ec331a09b082b76f7faa7ce
SHA512

e904c2db5c5b21f10a68aa053fc7e058903f5819b14688995df82e4b4eb2e2d76acd45a7659af5d1b049de3a55e74692cec405043b7a1e854b7741d171addcba

Score

8^/10

Blocklisted process makes network request 8 IoCs

Processes:

rundll32.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

rundll32.exe

Suspicious use of SendNotifyMessage 27 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1752 wrote to memory of 1340	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 1340	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 1340	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 1340	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 1340	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 1340	1752	rundll32.exe	rundll32.exe
PID 1752 wrote to memory of 1340	1752	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c93e3ebcef2a7cfe6fb8ee28f05920e94ebdce5a9ec331a09b082b76f7faa7ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752

memory/1340-54-0x0000000000000000-mapping.dmp

Download
memory/1340-55-0x0000000075541000-0x0000000075543000-memory.dmp

Filesize
8KB

Download