0a222596fb44938adfb2b8389c06f67dc29f6bdd9267b4b0e0bb1450e22fd53a

General

Target

896-56-0x0000000000290000-0x00000000002B2000-memory.dll
Size

136KB
MD5

9227b44f5e404cddbc609cb602bb6702
SHA1

bb80a6ab86ececd348520df7dd05c2420f628255
SHA256

0a222596fb44938adfb2b8389c06f67dc29f6bdd9267b4b0e0bb1450e22fd53a
SHA512

97674cbf688ffed328587000cbcb26b770f8cfedea3fe0c45df8109661dfa12ab06e8dff074636119e6992862dc3dbabaa43fb223ecac7ccec54236fce05985e

Score

1^/10

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1372 wrote to memory of 4972	1372	rundll32.exe	rundll32.exe
PID 1372 wrote to memory of 4972	1372	rundll32.exe	rundll32.exe
PID 1372 wrote to memory of 4972	1372	rundll32.exe	rundll32.exe
PID 4972 wrote to memory of 2408	4972	rundll32.exe	rundll32.exe
PID 4972 wrote to memory of 2408	4972	rundll32.exe	rundll32.exe
PID 4972 wrote to memory of 2408	4972	rundll32.exe	rundll32.exe
PID 2408 wrote to memory of 2920	2408	rundll32.exe	rundll32.exe
PID 2408 wrote to memory of 2920	2408	rundll32.exe	rundll32.exe
PID 2408 wrote to memory of 2920	2408	rundll32.exe	rundll32.exe
PID 2920 wrote to memory of 1904	2920	rundll32.exe	rundll32.exe
PID 2920 wrote to memory of 1904	2920	rundll32.exe	rundll32.exe
PID 2920 wrote to memory of 1904	2920	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 2924	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 2924	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 2924	1904	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 3052	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 3052	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 3052	2924	rundll32.exe	rundll32.exe
PID 3052 wrote to memory of 4776	3052	rundll32.exe	rundll32.exe
PID 3052 wrote to memory of 4776	3052	rundll32.exe	rundll32.exe
PID 3052 wrote to memory of 4776	3052	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-56-0x0000000000290000-0x00000000002B2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-56-0x0000000000290000-0x00000000002B2000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-56-0x0000000000290000-0x00000000002B2000-memory.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-56-0x0000000000290000-0x00000000002B2000-memory.dll,#1
4⤵
- Suspicious use of WriteProcessMemory
PID:2920

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-56-0x0000000000290000-0x00000000002B2000-memory.dll,#1
5⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-56-0x0000000000290000-0x00000000002B2000-memory.dll,#1
6⤵
- Suspicious use of WriteProcessMemory
PID:2924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-56-0x0000000000290000-0x00000000002B2000-memory.dll,#1
7⤵
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-56-0x0000000000290000-0x00000000002B2000-memory.dll,#1
8⤵
PID:4776