198c817204d7e72e30f7c7778d88c24898e653e54a08bc9ee9e9ecbbe8e79732

Resubmissions

09/01/2023, 01:55

09/01/2023, 01:49

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09/01/2023, 01:49

Target

MultiMC/Qt5Widgets.dll
Size

6.2MB
MD5

ce28c2432f00cba4a8c696325557f1a2
SHA1

421727e981f5e04bdf2e1bfda7a13a86a46749ba
SHA256

ca28b3a64023e2e91f508a17255cf44e5f573801e29d4a51ab340a7a060c8f90
SHA512

2d22687d19954a7de7c523a0a290109d816ac60a3bd5f33abd3782e59a124bb8d76b69f2f7b7ef525e2537a9e8dc27c99f6b8c019a5f4675f4add27c2b7ba25b
SSDEEP

98304:3Qk7k2hvd52bCbJNGjRQ8gyp3ezLHH7sowv4naTiN5312N63Lvj8mjgpURDtcChf:DzjJGRQByp3ezFQK5FV+TWi73

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 684	1428	rundll32.exe	27
PID 1428 wrote to memory of 684	1428	rundll32.exe	27
PID 1428 wrote to memory of 684	1428	rundll32.exe	27
PID 1428 wrote to memory of 684	1428	rundll32.exe	27
PID 1428 wrote to memory of 684	1428	rundll32.exe	27
PID 1428 wrote to memory of 684	1428	rundll32.exe	27
PID 1428 wrote to memory of 684	1428	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\Qt5Widgets.dll,#1
  2⤵
  PID:684

memory/684-55-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/684-56-0x0000000001FB0000-0x00000000024D0000-memory.dmp

Filesize
5.1MB

Download
memory/684-58-0x0000000068880000-0x0000000068DAE000-memory.dmp

Filesize
5.2MB

Download