cad0e84b5c7a0aa2f60edecd9edd8a0db0fcdf439de63db7f1a4a06f3ebcf09e

Resubmissions

31-03-2023 23:15

31-03-2023 23:09

max time kernel
28s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 23:09

Target

IGG-REDCON.v1.3.0/dbghelp.dll
Size

1.0MB
MD5

5c5e3afd499e5146fef1da5ef8a23205
SHA1

8245691416e509a3a1bd8e321aa6d2ff1925a224
SHA256

9a26ffaffb26fa6549c6da75f76238a903ca723f9dad356fba8d91067fe312fd
SHA512

595eb2a4928092a64224077a3fee0dc80a58cb12cf174bf648efe381f81846f345f1f1556cfd90026715ae4fd5c7913eeb46cc7df08f97118a76c58422e7d0dc
SSDEEP

24576:MA/j0DVD9vQYvfPlhPbZA28wtdzswxeqWiZUC82OLmoQKXIzrWNz:iVDZQYvfPlhPbZ97tdKeUC/OLmoQs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 920 wrote to memory of 916	920	rundll32.exe	rundll32.exe
PID 920 wrote to memory of 916	920	rundll32.exe	rundll32.exe
PID 920 wrote to memory of 916	920	rundll32.exe	rundll32.exe
PID 920 wrote to memory of 916	920	rundll32.exe	rundll32.exe
PID 920 wrote to memory of 916	920	rundll32.exe	rundll32.exe
PID 920 wrote to memory of 916	920	rundll32.exe	rundll32.exe
PID 920 wrote to memory of 916	920	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IGG-REDCON.v1.3.0\dbghelp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:920

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IGG-REDCON.v1.3.0\dbghelp.dll,#1
2⤵
PID:916