581baa5173ce5a2539f401aae6dbbed66f8141f39823ce5f60d9c93683e54964

Resubmissions

12/01/2024, 15:49

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 15:49

Target

GDHM_TASBOT_v36.9/RoastedMarshmellow.dll
Size

131KB
MD5

a16c532bc31d194b37f9d3279cca776b
SHA1

33eceb271aedb99fb6fe04adca2511b2343c2433
SHA256

8c36befca2a0ad82ffadc442bd6391bed8fcf855a398f3a8652332d087cf2afe
SHA512

9454dacaae91fd81786c8608a4af04fe67058eb7590c99a4bf7386ca1e0c7621cfbd20333cce9ebeb6bb9e1fb0d9acc1726640a95e7b2c16b95821e1686606b3
SSDEEP

3072:ArvdOcLB3FRvxIPHx/BNR//ct+NU5HMJXWHl4Y2pmnoQVHsMlBB:HyvkVFq61XSMQX

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral11/memory/2028-0-0x00000000747B0000-0x0000000074801000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2028	2016	rundll32.exe	16
PID 2016 wrote to memory of 2028	2016	rundll32.exe	16
PID 2016 wrote to memory of 2028	2016	rundll32.exe	16
PID 2016 wrote to memory of 2028	2016	rundll32.exe	16
PID 2016 wrote to memory of 2028	2016	rundll32.exe	16
PID 2016 wrote to memory of 2028	2016	rundll32.exe	16
PID 2016 wrote to memory of 2028	2016	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v36.9\RoastedMarshmellow.dll,#1
1⤵
PID:2028

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v36.9\RoastedMarshmellow.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016

memory/2028-0-0x00000000747B0000-0x0000000074801000-memory.dmp

Filesize
324KB

Download
memory/2028-1-0x00000000747B0000-0x0000000074801000-memory.dmp

Filesize
324KB

Download
memory/2028-2-0x00000000747B0000-0x0000000074801000-memory.dmp

Filesize
324KB

Download