10273efcac023d59fc68901d4d4fcf3ca59858fbca92ffb81243ccd49784218d

Analysis

max time kernel
11s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-03-2023 16:07

Target

GDHM_TASBOT_v35.6/RoastedMarshmellow.dll
Size

131KB
MD5

a16c532bc31d194b37f9d3279cca776b
SHA1

33eceb271aedb99fb6fe04adca2511b2343c2433
SHA256

8c36befca2a0ad82ffadc442bd6391bed8fcf855a398f3a8652332d087cf2afe
SHA512

9454dacaae91fd81786c8608a4af04fe67058eb7590c99a4bf7386ca1e0c7621cfbd20333cce9ebeb6bb9e1fb0d9acc1726640a95e7b2c16b95821e1686606b3
SSDEEP

3072:ArvdOcLB3FRvxIPHx/BNR//ct+NU5HMJXWHl4Y2pmnoQVHsMlBB:HyvkVFq61XSMQX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2020 wrote to memory of 1752	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1752	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1752	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1752	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1752	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1752	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 1752	2020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\RoastedMarshmellow.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\RoastedMarshmellow.dll,#1
2⤵
PID:1752