9868e15ce5dee4ac08bbb900151fae026a036f5f80c9b6bc5f8746b64002aec5

Resubmissions

14/02/2024, 10:18

14/02/2024, 10:16

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 10:18

Target

$PLUGINSDIR/CLR.dll
Size

93KB
MD5

732691c7a1ef4e7decb9d8c52010a709
SHA1

ecbf0bbcb051433d570e212e73a883f8e5f19996
SHA256

5f3573a00f3333d7587044f59b72511263103525d2cdfe79475c6726735d0812
SHA512

fcbde499f9592ae25b757e805892f43ffe50c475bc54ea3e992bc2db647e42d661c3dad2c4056da89fe4a62365f5b57df24d1083382ebdbd146bfb83d48d167a
SSDEEP

1536:XJgC8K1IbncO54uknhaaA7qbFG8iY2h+7OiYtlmctUudvmpfD65OgOj:XJf8K1ITc3A7qbFG8iY2h+7OiYtlmctu

Score

1^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3048	3040	rundll32.exe	28
PID 3040 wrote to memory of 3048	3040	rundll32.exe	28
PID 3040 wrote to memory of 3048	3040	rundll32.exe	28
PID 3040 wrote to memory of 3048	3040	rundll32.exe	28
PID 3040 wrote to memory of 3048	3040	rundll32.exe	28
PID 3040 wrote to memory of 3048	3040	rundll32.exe	28
PID 3040 wrote to memory of 3048	3040	rundll32.exe	28
PID 3048 wrote to memory of 3056	3048	rundll32.exe	29
PID 3048 wrote to memory of 3056	3048	rundll32.exe	29
PID 3048 wrote to memory of 3056	3048	rundll32.exe	29
PID 3048 wrote to memory of 3056	3048	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CLR.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CLR.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 460
    3⤵
    PID:3056

memory/3048-0-0x0000000000340000-0x0000000000380000-memory.dmp

Filesize
256KB

Download
memory/3048-1-0x0000000073DE0000-0x000000007438B000-memory.dmp

Filesize
5.7MB

Download
memory/3048-2-0x0000000073DE0000-0x000000007438B000-memory.dmp

Filesize
5.7MB

Download
memory/3048-4-0x0000000000340000-0x0000000000380000-memory.dmp

Filesize
256KB

Download
memory/3056-3-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

Filesize
4KB

Download
memory/3056-5-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

Filesize
4KB

Download