b93aaa33295a7b67f4b350268b6cfe9fbea7916f5e40918755dfd47af78828f9

Analysis

max time kernel
41s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 10:35

Target

Mbot repack by DarkSideOfSoul/Detour.dll
Size

58KB
MD5

519fb61d24a6bb5ca730b9ecbd201593
SHA1

400f472c2fdc54bb36e16185a6c3d8ae2d00ff60
SHA256

c643712e9554395345268041e96450143a30a66638cb8f35f8307bb95b4aacc4
SHA512

fda314ff39f0a4e6cf3cb07f1f0750d238ac824c94eb8e02c66feb7a5f90758b1bfebf4694b665d60d4cbcd41aaedfc9f140bc44d85400cd7f0e767962984c0e
SSDEEP

768:W669srHegXVuwbVzAEsc3zMfJZLHDtPBCBGjqGkhdQJyRPRuXAWu5jZA:W6LrHVuk/x3ziJP4BGOdxRuvuvA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 888 wrote to memory of 736	888	rundll32.exe	rundll32.exe
PID 888 wrote to memory of 736	888	rundll32.exe	rundll32.exe
PID 888 wrote to memory of 736	888	rundll32.exe	rundll32.exe
PID 888 wrote to memory of 736	888	rundll32.exe	rundll32.exe
PID 888 wrote to memory of 736	888	rundll32.exe	rundll32.exe
PID 888 wrote to memory of 736	888	rundll32.exe	rundll32.exe
PID 888 wrote to memory of 736	888	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Mbot repack by DarkSideOfSoul\Detour.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Mbot repack by DarkSideOfSoul\Detour.dll",#1
  2⤵
  PID:736

memory/736-54-0x0000000000000000-mapping.dmp

Download
memory/736-55-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download