90e2d50df5ac5b437e21ed7f744bb1bbfdbec751e2093cf497c166cd43acc59d

Resubmissions

26-05-2023 11:29

26-05-2023 11:27

max time kernel
403s
max time network
445s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
26-05-2023 11:27

Target

Evon/Fluxteam_net_API.dll
Size

6.2MB
MD5

a2513af40b51c5cc3466c71ab27d5fa7
SHA1

b310730fb278b8d7999685aee61157bad1292680
SHA256

5c7d8c252a04215e6f05d6d403bb962f3c992fd4ef73ccfb18740edb3a2ba5c0
SHA512

bab201d494805cc5b958a84fdc8418cc03f392c3a88e9f127d6ecfa2147a4d542631194de4372cd339117072da8b7d36e03cde27b1ac4de03446ea4b44183ea0
SSDEEP

98304:IMVIlDNm2F/Q08Br5NdvX/vhsHDlGxLMVhZyaj0xO6oosxiS11VUTGzEdqGfE6/2:QlvFIF7dnvhsRjHZyaj0wRUTGuM6wf

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

4556 rundll32.exe
4556 rundll32.exe
4556 rundll32.exe
4556 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2224 wrote to memory of 4556	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 4556	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 4556	2224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Evon\Fluxteam_net_API.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Evon\Fluxteam_net_API.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4556

memory/4556-120-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/4556-121-0x0000000073BA0000-0x0000000074524000-memory.dmp

Filesize
9.5MB

Download