c89e2b54f3c5d87685524102f4a03430e99d41ff6541c99e97b379ab7f5a413c

Resubmissions

04/05/2024, 10:29

04/05/2024, 09:56

max time kernel
50s
max time network
52s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 10:29

Reason

Machine shutdown

Target
Vulcan1.5 BETA/CED3D10Hook.dll
Size 128KB
Sample240504-mjf6eabb91
SHA256 148f12445f11a50efbd23509139bf06a47d453e8514733b5a15868d10cc6e066
MD5 43dac1f3ca6b48263029b348111e3255
SHA1 9e399fddc2a256292a07b5c3a16b1c8bdd8da5c1
SHA512 6e77a429923b503fc08895995eb8817e36145169c2937dacc2da92b846f45101846e98191aeb4f0f2f13fff05d0836aa658f505a04208188278718166c5e3032
SSDEEP 1536:jRXPVJPMo10+PfXl/IRTlsfQstLh66crJWeWyPCUpfrCWV13P1+CUOEvCvOEMI7:BdJPMlMb1g6e0dU9rf3P7UObvOja
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28
PID 1732 wrote to memory of 1784	1732	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Vulcan1.5 BETA\CED3D10Hook.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Vulcan1.5 BETA\CED3D10Hook.dll",#1
  2⤵
  PID:1784

memory/2448-1-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Download

memory/2660-0-0x0000000002E10000-0x0000000002E11000-memory.dmp

Download