e3ff5ca6952b263f1e3280b8ac648316a25fe1b5be45dae11317918d8856612a

Resubmissions

05-04-2024 15:10

20-12-2023 19:03

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 19:03

Target

dino.dll
Size

5.5MB
MD5

f302435807a6a769728d89ac4fc1bd43
SHA1

c6ea54068d7deaeb3fc3c31edd3c336b804505db
SHA256

d98cd810d568f338f16c4637e8a9cb01ff69ee1967f4cfc004de3f283d61ba81
SHA512

dfd72aa484547da9b463e54fbb81bdb48597aaaff74015735d896d5348c86114210eec6d3e2069608e341dc4f37f305e9716a2cf8d1d6f00edcbc76668945e08
SSDEEP

98304:p0nxA1cmzOfO8fv1CPwDv3uFhaYtQBPoqahqLVfK7vVFw6bIRpACgv5IgpYObtJT:2dmCf/fv1CPwDv3uFhaoQBPolhqL9Kbd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2264 wrote to memory of 1676	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1676	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1676	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1676	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1676	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1676	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1676	2264	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dino.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dino.dll,#1
2⤵
PID:1676