e87928fcddf13935c91a0b5577e28efd29bb6a5c1d98e5129dec63e231601053

Resubmissions

16/10/2023, 15:02

16/10/2023, 14:55

16/10/2023, 14:14

max time kernel
143s
max time network
269s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 14:55

Target
mesoc.dll
Size 778KB
Sample231016-sasezaba44
SHA256 e87928fcddf13935c91a0b5577e28efd29bb6a5c1d98e5129dec63e231601053
MD5 a443f1622069aab6d8939491859e7cdb
SHA1 f5dc559c1a1dfc96dd768f0bbe3036625784039c
SHA512 167c848eba8cf44b818484381e3bb2a4be009b95c7f3a0994e3a394cc3161345b0a79aa38466398f3aa710f538a4c67ca792fa5a431d8c153ca3bb10de5a9cb0
SSDEEP 6144:GhQd+ZW/3TvUCWysU2XN92nIMkS9yjygIL1ZaquKIwsjd5vRukMi/mf+0Hlqn//f:sEv9yjpIrH6BjfEkPmt+/bYujcpZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3008	2724	cmd.exe	100
PID 2724 wrote to memory of 3008	2724	cmd.exe	100

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mesoc.dll,#1
1⤵
PID:440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\system32\rundll32.exe
  rundll32 mesoc.dll scab /k hava1462
  2⤵
  PID:3008