0d349b6bf414eabec5f852193876fe67bcaa109089e631a2b6d72650f3b5d95f

Analysis

Target

896-57-0x0000000000AD0000-0x0000000000AF2000-memory.dll
Size

136KB
MD5

e455c6f59629f02d41ecbd2c0bc6b918
SHA1

351d693df955de8cab91472e11a09963483233ae
SHA256

0d349b6bf414eabec5f852193876fe67bcaa109089e631a2b6d72650f3b5d95f
SHA512

1917e303fb6539005b050381c4f544e752d61c7ec3ac8114e9d632dc864748aa997fe12115b244fb4ad426b007da0caa851e7a98a02fa8b6b56cec407967b9ac

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 5016 wrote to memory of 380	5016	rundll32.exe	rundll32.exe
PID 5016 wrote to memory of 380	5016	rundll32.exe	rundll32.exe
PID 5016 wrote to memory of 380	5016	rundll32.exe	rundll32.exe
PID 380 wrote to memory of 5032	380	rundll32.exe	rundll32.exe
PID 380 wrote to memory of 5032	380	rundll32.exe	rundll32.exe
PID 380 wrote to memory of 5032	380	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-57-0x0000000000AD0000-0x0000000000AF2000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-57-0x0000000000AD0000-0x0000000000AF2000-memory.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\896-57-0x0000000000AD0000-0x0000000000AF2000-memory.dll,#1
    3⤵
    PID:5032