IOC Report
eNtYgxj1lX.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Windows\System32\loaddll64.exe
loaddll64.exe "C:\Users\user\Desktop\eNtYgxj1lX.dll"
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\eNtYgxj1lX.dll",#1
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\cmd.exe
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\eNtYgxj1lX.dll",#1

Memdumps

Base Address
Regiontype
Protect
Malicious
26F83F20000
heap
page read and write
BF1707D000
stack
page read and write
20FFA250000
trusted library allocation
page read and write
7FFB226C1000
unkown
page execute read
26F83F10000
heap
page read and write
26F83F40000
heap
page read and write
7FFB226C8000
unkown
page readonly
7FFB226C9000
unkown
page read and write
7FFB226C8000
unkown
page readonly
26F84150000
trusted library allocation
page read and write
26F83F68000
heap
page read and write
26F84310000
heap
page read and write
7FFB226C1000
unkown
page execute read
20FFA26D000
heap
page read and write
7FFB226C0000
unkown
page readonly
26F84150000
unclassified section
page read and write
20FFA278000
heap
page read and write
802A5EB000
stack
page read and write
26F83F6F000
heap
page read and write
7FFB226CB000
unkown
page readonly
20FFA250000
unclassified section
page read and write
26F84315000
heap
page read and write
7FFB226CB000
unkown
page readonly
7FFB226C0000
unkown
page readonly
20FFA220000
heap
page read and write
7FFB226C9000
unkown
page read and write
20FFA210000
heap
page read and write
26F84150000
trusted library allocation
page read and write
20FFA430000
trusted library allocation
page read and write
20FFA269000
heap
page read and write
20FFA260000
heap
page read and write
26F83F60000
heap
page read and write
There are 22 hidden memdumps, click here to show them.