dcd5b76de9828767e8acbfcf3be792fbd1b777651ca2e802294989bae7ddf1d9

Resubmissions

14/05/2023, 21:59

14/05/2023, 20:19

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2023, 20:19

Target

InvChanger/InvChanger.dll
Size

1.4MB
MD5

0da95079a28bead086bdebf58a18512b
SHA1

573d15c36f83ef61eff9739df5a4be8704d33fa7
SHA256

98b9f44e37cb6d7cab5fb85600904be7f5dcb3d4b3e52a3a9f21ba0e6f5d47f5
SHA512

427d78b893386d1c022169f197353b2e1f0872785aa3d9e5d22e253e2b9c8434cd34f9dff39815555e1d7a5a69ea3387ebe15c055bbb2d1ce9b113386fc93be6
SSDEEP

24576:Sj1caock6Kt3i2GAVhL12gMPJ+2mG8WDR/g+XSJtKwTg9/2j8UjFWke3TDWRsSt:Sj5zK9jhLO7dnSWws9/2YUA3TDqt

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2640	756	rundll32.exe	83
PID 756 wrote to memory of 2640	756	rundll32.exe	83
PID 756 wrote to memory of 2640	756	rundll32.exe	83
PID 2640 wrote to memory of 4872	2640	rundll32.exe	85
PID 2640 wrote to memory of 4872	2640	rundll32.exe	85
PID 2640 wrote to memory of 4872	2640	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\InvChanger\InvChanger.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\InvChanger\InvChanger.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c title InvChanger Free
    3⤵
    PID:4872