b93aaa33295a7b67f4b350268b6cfe9fbea7916f5e40918755dfd47af78828f9

Analysis

max time kernel
288s
max time network
318s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 10:35

Target

Mbot repack by DarkSideOfSoul/psilk.dll
Size

87KB
MD5

f10823b20021569726929cbe2b3e9114
SHA1

b6c2d20b32bb5ed658e050dd046e307137fe24b2
SHA256

bcc0a22aabea03511150c83e0573ce73d0035d2df7fe3302d0cf499066aa6457
SHA512

cff9344b18d2ab2a19bdcab633a74a7eff8b3e3740d5293f695d57a7345cb0596cc56d0b6e151d876e190fabf1f051a879e9b52745a10bc63f48b16b68e4d894
SSDEEP

1536:l0ylvve3dQYQrk5cbGmQ5Rzyt0yMm0OFgzLa5k0II:SovGj8ycbGmQ5RzytVMm0OFga5r

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4532 wrote to memory of 4496	4532	rundll32.exe	rundll32.exe
PID 4532 wrote to memory of 4496	4532	rundll32.exe	rundll32.exe
PID 4532 wrote to memory of 4496	4532	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Mbot repack by DarkSideOfSoul\psilk.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Mbot repack by DarkSideOfSoul\psilk.dll",#1
  2⤵
  PID:4496