e87928fcddf13935c91a0b5577e28efd29bb6a5c1d98e5129dec63e231601053

Resubmissions

16-10-2023 15:02

16-10-2023 14:55

16-10-2023 14:14

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16-10-2023 14:14

Target

mesoc.dll
Size

778KB
MD5

a443f1622069aab6d8939491859e7cdb
SHA1

f5dc559c1a1dfc96dd768f0bbe3036625784039c
SHA256

e87928fcddf13935c91a0b5577e28efd29bb6a5c1d98e5129dec63e231601053
SHA512

167c848eba8cf44b818484381e3bb2a4be009b95c7f3a0994e3a394cc3161345b0a79aa38466398f3aa710f538a4c67ca792fa5a431d8c153ca3bb10de5a9cb0
SSDEEP

6144:GhQd+ZW/3TvUCWysU2XN92nIMkS9yjygIL1ZaquKIwsjd5vRukMi/mf+0Hlqn//f:sEv9yjpIrH6BjfEkPmt+/bYujcpZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2960	2956	rundll32.exe	28
PID 2956 wrote to memory of 2960	2956	rundll32.exe	28
PID 2956 wrote to memory of 2960	2956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mesoc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2956 -s 100
  2⤵
  PID:2960