7559e6ca8b77400f88bf4e67208a1c32570a670068eccae9e3d226cc5471bd47

Resubmissions

28-04-2024 18:31

21-04-2024 08:57

21-04-2024 05:45

18-04-2024 19:05

18-04-2024 16:34

04-03-2024 18:33

02-03-2024 17:01

02-03-2024 10:05

max time kernel
1443s
max time network
1510s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
18-04-2024 16:34

Target

bazaar.2020.02/HEUR-Trojan-Ransom.Win32.Sodin.dll
Size

164KB
MD5

72945c9b41b3590dc518b14bad0a79ee
SHA1

244e30fcd8982b78eaac65db21b177b632c1fb11
SHA256

44bcefd86b7d36300eb2d77ba88f248cab5ecb9cfb0ec3e859e35ed519fa7795
SHA512

2eca816b31f21afe4daadaed3ed2e891f9632ff5652ae6e6e2ebde7dee0f6b1ec3562af8ef98dd9fb769c8f372a8f527e6a22cb2686ac43bc49fd6f21081f06c
SSDEEP

3072:v0XoUeZ/DVS8L73ea4MoCLfqQvFf/7lrKq:veoUeZR2TRCWQFfDl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4108 wrote to memory of 1756	4108	rundll32.exe	79
PID 4108 wrote to memory of 1756	4108	rundll32.exe	79
PID 4108 wrote to memory of 1756	4108	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Ransom.Win32.Sodin.dll,#1
  2⤵
  PID:1756