437c8032e578d678d10379c25af38953c41821103fb2d7d25f6a229fdd2bec10 | Triage

Resubmissions

13/02/2023, 23:37

230213-3l6rvahb62 7

13/02/2023, 23:36

230213-3lx5psge5x 7

13/02/2023, 23:35

230213-3lhd9age41 8

13/02/2023, 23:35

230213-3k79aage4y 7

13/02/2023, 23:35

230213-3k15zahb58 8

13/02/2023, 23:34

230213-3kvyyshb56 8

13/02/2023, 23:34

230213-3kqdgage4w 8

13/02/2023, 23:34

230213-3kk4rahb53 7

13/02/2023, 23:34

230213-3kexqsge4s 7

13/02/2023, 23:33

230213-3j92gsge31 7

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
13/02/2023, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Borrador/IObitUnlocker.dll
Size

71KB
MD5

6dc47f0038dd44de1c3a854949572774
SHA1

a5b74648a3944ac1781c89d3f549715e31eb5c85
SHA256

9e93fbb7955710e50a1ef4a222253a349927a543b105bfe26d4803ddc54060a9
SHA512

52caeb12ff1a57362e0c80f22221311df453eaeec6ba4e39b67942ad0ae6f8fc39b17bfe951f04c3d1d0a6b455bf91e9b1c2df5ad284bf6c2c8b0dd671c37d96
SSDEEP

1536:0gr2Lr071OUKFOk12oilFHyKyXMuJwIzD:0grviGoiiKycuew

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28
PID 1160 wrote to memory of 1888	1160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Borrador\IObitUnlocker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Borrador\IObitUnlocker.dll,#1
  2⤵
  PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download