131ef41cecf434e04f594d28c30d640a4c2e717d939b9914e551e3c746d85a74

Analysis

Target

131ef41cecf434e04f594d28c30d640a4c2e717d939b9914e551e3c746d85a74.dll
Size

164KB
MD5

792bf3584c0254eca38f9ba6c6eab5d3
SHA1

0201ecacfaa708dcf50257b2db3e37a21318c2ed
SHA256

131ef41cecf434e04f594d28c30d640a4c2e717d939b9914e551e3c746d85a74
SHA512

e544be1d58b897a1d2f9bd7fa47acdab203a8ba36cacfe35fa0062751b7b4c52fd1a8e1af0ed4bad99d1325a046317f3cda6d73b25454a08d946a6934c544aac

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 676 wrote to memory of 1504	676	rundll32.exe	rundll32.exe
PID 676 wrote to memory of 1504	676	rundll32.exe	rundll32.exe
PID 676 wrote to memory of 1504	676	rundll32.exe	rundll32.exe
PID 676 wrote to memory of 1504	676	rundll32.exe	rundll32.exe
PID 676 wrote to memory of 1504	676	rundll32.exe	rundll32.exe
PID 676 wrote to memory of 1504	676	rundll32.exe	rundll32.exe
PID 676 wrote to memory of 1504	676	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\131ef41cecf434e04f594d28c30d640a4c2e717d939b9914e551e3c746d85a74.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:676

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\131ef41cecf434e04f594d28c30d640a4c2e717d939b9914e551e3c746d85a74.dll,#1
2⤵
PID:1504

memory/1504-54-0x0000000000000000-mapping.dmp

Download
memory/1504-55-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/1504-57-0x0000000002FA0000-0x000000000303F000-memory.dmp

Filesize
636KB

Download
memory/1504-59-0x0000000000300000-0x000000000031F000-memory.dmp

Filesize
124KB

Download
memory/1504-60-0x00000000034A0000-0x00000000035A9000-memory.dmp

Filesize
1.0MB

Download
memory/1504-61-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1504-62-0x00000000001F0000-0x00000000001F6000-memory.dmp

Filesize
24KB

Download