0221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70

General

Target

0221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70.dll
Size

4.5MB
MD5

d73134c0b780595c6c95f8568c1f81a7
SHA1

19bd711b9d66df0353f5d74ae9ef6c30909dba78
SHA256

0221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70
SHA512

e2e6659efdd82ab817c61cfb40669736c2db8c73737de571df7470f5477730e03cb32910e31304fba27dba754de80f7dbe8bdef73a280299b3d9fd307dbea176

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

4808 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

4808 rundll32.exe

pid	process
4808	rundll32.exe

pid	process
4808	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3452 wrote to memory of 4808	3452	rundll32.exe	rundll32.exe
PID 3452 wrote to memory of 4808	3452	rundll32.exe	rundll32.exe
PID 3452 wrote to memory of 4808	3452	rundll32.exe	rundll32.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe
PID 4808 wrote to memory of 780	4808	rundll32.exe	nslookup.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3452

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808

C:\Windows\SysWOW64\nslookup.exe
"C:\Windows\system32\nslookup.exe"
3⤵
PID:780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-133-0x0000000000000000-mapping.dmp

Download
memory/780-135-0x0000000002E30000-0x0000000002E38000-memory.dmp

Filesize
32KB

Download
memory/4808-130-0x0000000000000000-mapping.dmp

Download
memory/4808-131-0x0000000002400000-0x0000000002898000-memory.dmp

Filesize
4.6MB

Download
memory/4808-132-0x0000000002920000-0x00000000029AD000-memory.dmp

Filesize
564KB

Download
memory/4808-134-0x0000000002920000-0x00000000029AD000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads