437c8032e578d678d10379c25af38953c41821103fb2d7d25f6a229fdd2bec10 | Triage

Analysis

max time kernel
28s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31/03/2023, 00:43

Sharing

Report Analysis Logs

General

Target

Borrador/IObitUnlocker.dll
Size

71KB
MD5

6dc47f0038dd44de1c3a854949572774
SHA1

a5b74648a3944ac1781c89d3f549715e31eb5c85
SHA256

9e93fbb7955710e50a1ef4a222253a349927a543b105bfe26d4803ddc54060a9
SHA512

52caeb12ff1a57362e0c80f22221311df453eaeec6ba4e39b67942ad0ae6f8fc39b17bfe951f04c3d1d0a6b455bf91e9b1c2df5ad284bf6c2c8b0dd671c37d96
SSDEEP

1536:0gr2Lr071OUKFOk12oilFHyKyXMuJwIzD:0grviGoiiKycuew

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1144	2044	rundll32.exe	17
PID 2044 wrote to memory of 1144	2044	rundll32.exe	17
PID 2044 wrote to memory of 1144	2044	rundll32.exe	17
PID 2044 wrote to memory of 1144	2044	rundll32.exe	17
PID 2044 wrote to memory of 1144	2044	rundll32.exe	17
PID 2044 wrote to memory of 1144	2044	rundll32.exe	17
PID 2044 wrote to memory of 1144	2044	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Borrador\IObitUnlocker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Borrador\IObitUnlocker.dll,#1
  2⤵
  PID:1144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads