7559e6ca8b77400f88bf4e67208a1c32570a670068eccae9e3d226cc5471bd47

Resubmissions

28-04-2024 18:31

21-04-2024 08:57

21-04-2024 05:45

18-04-2024 19:05

18-04-2024 16:34

04-03-2024 18:33

02-03-2024 17:01

02-03-2024 10:05

max time kernel
141s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
02-03-2024 17:01

Target

bazaar.2020.02/HEUR-Trojan-Ransom.Win32.Sodin.dll
Size

164KB
MD5

2756f86ef462729bd072ef2d05f00f54
SHA1

b074e97c19bc69d39c235c763675b492e2e216f1
SHA256

38beb0ea97e3c5758b4839b8874d552a6ddce7bcde77986c62bf49041e229bc6
SHA512

9c6a618870ebb1a50bd647f26327d4ab25905c8d438e1f71be87f343e91d58c0e4683afeefc7f725b091cb1a47b5e7fa30d99402fb4296a88e8a5b138ef62d14
SSDEEP

3072:v0XoUeZ/DVS8L73ea4MoCLfqQvFf9eRIL8nmm:veoUeZR2TRCWQFf9eR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1344 wrote to memory of 1120	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1120	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1120	1344	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#1
2⤵
PID:1120