d80f9618ef8369e54986f2abf564e5eeccf961d3ddaca515622412b1e4648d4c

Resubmissions

20/04/2024, 17:13

12/03/2024, 21:36

10/03/2024, 04:41

10/03/2024, 04:40

10/03/2024, 04:38

09/03/2024, 07:38

max time kernel
30s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
10/03/2024, 04:38

Target
Reaper/Reaper/injector.dll
Size 19KB
Sample240310-e9wd1scc82
SHA256 d986554d185d3f4e827a1287322210ff6a143ed723d203efbf00a8757aa13714
MD5 a4db6b21f7398882100909f37c1067a4
SHA1 7b2a61d09e4959f4578b556196a8405a2f6e45f3
SHA512 42bafe3ef80a748db64dfc88a159a06ee33cecb3f709f01d9c1a9e38d3ab81008f3226963c1c2e926f5e4b6e9442fd2f8a89b0fa5425d04db869cf7be7bddd31
SSDEEP 384:5xE24iKOgW7+uPOxQkWWma3NCx7cTuOJ9jIwq6Am:5JVKVxPXWWmgIx7cKOEZFm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4700	5088	rundll32.exe	81
PID 5088 wrote to memory of 4700	5088	rundll32.exe	81
PID 5088 wrote to memory of 4700	5088	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Reaper\Reaper\injector.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Reaper\Reaper\injector.dll,#1
  2⤵
  PID:4700