f566f21f3db0c4a9f421f18e6561279b4dd4c5fd3c32456a6f2e5b927b49719d

Resubmissions

23-05-2024 09:35

28-04-2024 14:29

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 09:35

Target

LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit3Builder/Build/LB3_Rundll32.dll
Size

152KB
MD5

6af251afa3468ac14d63b0ee96acf337
SHA1

b9f28640e74b50a487c71b3d866a5a9905e79077
SHA256

d146fc2a8a8be652bbaaf711d3f4861de2f859192e8e90a8d03b6ffd4bcece46
SHA512

84a5958c0d46b464f1b5e6d3164b69533ca2950aa35df4fd36bbfbf479ef780fc619904a08d2bf65835a09552f0663c8847471b565859d84b684247a4eb3fe6b
SSDEEP

3072:1T0IRcT5h98vy7aF5y9vYNahEvM1kiXo7CAyXwptXpEKAoiO3pwBmrkllnYgrwoW:1T5CTL98vy7anEvY8hEvM1kiXolyXwpp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3076	3212	rundll32.exe	83
PID 3212 wrote to memory of 3076	3212	rundll32.exe	83
PID 3212 wrote to memory of 3076	3212	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3_Rundll32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit3Builder\Build\LB3_Rundll32.dll,#1
  2⤵
  PID:3076