dcd5b76de9828767e8acbfcf3be792fbd1b777651ca2e802294989bae7ddf1d9

Resubmissions

14/05/2023, 21:59

14/05/2023, 20:19

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/05/2023, 21:59

Target

InvChanger/InvChanger.dll
Size

1.4MB
MD5

0da95079a28bead086bdebf58a18512b
SHA1

573d15c36f83ef61eff9739df5a4be8704d33fa7
SHA256

98b9f44e37cb6d7cab5fb85600904be7f5dcb3d4b3e52a3a9f21ba0e6f5d47f5
SHA512

427d78b893386d1c022169f197353b2e1f0872785aa3d9e5d22e253e2b9c8434cd34f9dff39815555e1d7a5a69ea3387ebe15c055bbb2d1ce9b113386fc93be6
SSDEEP

24576:Sj1caock6Kt3i2GAVhL12gMPJ+2mG8WDR/g+XSJtKwTg9/2j8UjFWke3TDWRsSt:Sj5zK9jhLO7dnSWws9/2YUA3TDqt

Score

1^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1224	848	rundll32.exe	28
PID 848 wrote to memory of 1224	848	rundll32.exe	28
PID 848 wrote to memory of 1224	848	rundll32.exe	28
PID 848 wrote to memory of 1224	848	rundll32.exe	28
PID 848 wrote to memory of 1224	848	rundll32.exe	28
PID 848 wrote to memory of 1224	848	rundll32.exe	28
PID 848 wrote to memory of 1224	848	rundll32.exe	28
PID 1224 wrote to memory of 1340	1224	rundll32.exe	30
PID 1224 wrote to memory of 1340	1224	rundll32.exe	30
PID 1224 wrote to memory of 1340	1224	rundll32.exe	30
PID 1224 wrote to memory of 1340	1224	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\InvChanger\InvChanger.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\InvChanger\InvChanger.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c title InvChanger Free
    3⤵
    PID:1340