e4b6ffbd9a7484dd39aaca1d71663ee8cc3875657cd2f0de3bceaa02ba982d50

Analysis

max time kernel
59s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 01:58

Target

BitRAT/data/tor/libwinpthread-1.dll
Size

522KB
MD5

99e20eea1d13e718eb0fe9d61659c87f
SHA1

4ee7eb374a027b06190bfe8d7d444d25a955a5a2
SHA256

c99eb9c243c18fe9363ed232fed3ef4f171a90be2a6b957f9a480f5eaf66b4ca
SHA512

5eeae53cc852e4134cfdfca2454b7b8489a0a5d5a4100fc68aa97302197ac8e6558a5ecefd3decade2d3e5a051d6bcf50c4cd0713dfd614c11fea9cd542af33c
SSDEEP

12288:EQbim3YIiU6lotAH7I/zvbttl4/MKKDLVcqUuzpoM7wTivFo:Fbim3YRU6lotk7I/zvbttl4/MKKfVcqK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3532 wrote to memory of 2196	3532	rundll32.exe	rundll32.exe
PID 3532 wrote to memory of 2196	3532	rundll32.exe	rundll32.exe
PID 3532 wrote to memory of 2196	3532	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BitRAT\data\tor\libwinpthread-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3532

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BitRAT\data\tor\libwinpthread-1.dll,#1
2⤵
PID:2196