581baa5173ce5a2539f401aae6dbbed66f8141f39823ce5f60d9c93683e54964

Resubmissions

12/01/2024, 15:49

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 15:49

Target

GDHM_TASBOT_v36.9/xinput9_1_0.dll
Size

25KB
MD5

25672c39c74a689dc635a57b7d0619b4
SHA1

d4d6ccfa30b972a92a50cae4d6ef018a0254a88f
SHA256

3e0546d87fb9d944ed3fcc4d5e4abd883a40e3d146b3b66fa7b1f32f5d196ccb
SHA512

3111105f082e282dc251b1f1e75ba9dac18f74de3d294746214a8c388da236f51fdf31526a5932dacce83d1daa45288234dcad2b54cc2a143e6df13610d9aa94
SSDEEP

384:YPivlhMRrRkW3HsejWS0mXhcJv/iZ+Zj+auw8exGSumyJRiRjma0AshLSbG6v1Ay:gNRXXh+vq9Uxjyn3AEJ6v1A

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1320	864	rundll32.exe	90
PID 864 wrote to memory of 1320	864	rundll32.exe	90
PID 864 wrote to memory of 1320	864	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v36.9\xinput9_1_0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v36.9\xinput9_1_0.dll,#1
  2⤵
  PID:1320

memory/1320-0-0x00000000752D0000-0x0000000075321000-memory.dmp

Filesize
324KB

Download