7783fb922abee77ebc12618187fe164cf8beecbedf4e8e91ad08434ccacc929b

Resubmissions

19/04/2023, 15:23

19/04/2023, 13:39

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/04/2023, 15:23

Target

b0r1sCantMakeUphisMind.dll
Size

977KB
MD5

57a01187097a9f0bc4bbb77a50f9d9f8
SHA1

576463418b6813334b58a0dc19c2aa05bc3cea91
SHA256

7783fb922abee77ebc12618187fe164cf8beecbedf4e8e91ad08434ccacc929b
SHA512

6a7d740e0da849b8ab720e097cc5052ab12af47b2e79687e22edf8cae2115d6bfc9078d9fc4ccc4efe6e8c9703783ae8420ed49a5476f72dbdb3c1173c801bd8
SSDEEP

12288:dIAETyZizswDZr2rnVed8b2NFCKh6RaG7EeDATbURJTdL7K2Lzla:dI3AwDj02Nlh6IG7EeYU7TVW2Lzla

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1584	1676	rundll32.exe	28
PID 1676 wrote to memory of 1584	1676	rundll32.exe	28
PID 1676 wrote to memory of 1584	1676	rundll32.exe	28
PID 1676 wrote to memory of 1584	1676	rundll32.exe	28
PID 1676 wrote to memory of 1584	1676	rundll32.exe	28
PID 1676 wrote to memory of 1584	1676	rundll32.exe	28
PID 1676 wrote to memory of 1584	1676	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0r1sCantMakeUphisMind.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0r1sCantMakeUphisMind.dll,#1
  2⤵
  PID:1584