2ae853f0b83d3dffeaf192cb3e64209ad52bbfd5f0c41f85f1e1cea7217e3dc4

Resubmissions

07-05-2024 12:38

16-10-2023 16:11

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 12:38

Target

Birdman/Birdman.dll
Size

1.8MB
MD5

ec8db58467d8e2e2221635c592fcca1a
SHA1

e0215d156d2dc59b6259fd5ff792dc740626c8fa
SHA256

aebff5134e07a1586b911271a49702c8623b8ac8da2c135d4d3b0145a826f507
SHA512

5aaf241388dbb343e059af4a0cfd4d7507189f0c94f415ba9b9d87791e5f2bf81a780f73e2bbc8bb39f90edc779987eb422192fb3facb4c0dae78c140cacb787
SSDEEP

24576:FSfBk+9Zl7pC4HE+Y/lU/Z46vVJkWuQpJ53am1u46FxVDmdVxoejIF4UAVddHctD:6kFhgJ8m1u/CVxodFSfd+WC9J

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2408	1516	rundll32.exe	28
PID 1516 wrote to memory of 2408	1516	rundll32.exe	28
PID 1516 wrote to memory of 2408	1516	rundll32.exe	28
PID 1516 wrote to memory of 2408	1516	rundll32.exe	28
PID 1516 wrote to memory of 2408	1516	rundll32.exe	28
PID 1516 wrote to memory of 2408	1516	rundll32.exe	28
PID 1516 wrote to memory of 2408	1516	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Birdman\Birdman.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Birdman\Birdman.dll,#1
  2⤵
  PID:2408

memory/2408-0-0x00000000006A0000-0x000000000075D000-memory.dmp

Filesize
756KB

Download
memory/2408-1-0x0000000002150000-0x0000000002222000-memory.dmp

Filesize
840KB

Download
memory/2408-2-0x0000000002150000-0x0000000002222000-memory.dmp

Filesize
840KB

Download