f566f21f3db0c4a9f421f18e6561279b4dd4c5fd3c32456a6f2e5b927b49719d

Resubmissions

23-05-2024 09:35

28-04-2024 14:29

max time kernel
136s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 09:35

Target

LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/LB3_Rundll32.dll
Size

152KB
MD5

a451f94bf71b55142e64d65dda361e3d
SHA1

79dbdba2019c0bb2859cf2886ad4ceaadf769311
SHA256

42a708a61e3bb54ac63748ac47bb96ded6e32bbe927a87c8e57094110293c325
SHA512

a5336d7a3345a562214f8081459937f4c9c17882aa614fa514eea6ec7e3afd416e943560a92ecfe88ecc281729c9e6eefe2300d087b1ee510aaef0d3ac343803
SSDEEP

3072:LrPn1hcH98P67PBH2G3gFoh3H6J1vVjgQp3RpM1dpbQrQymzUOMgInmwuzEvigpx:LrP1hG98P67PNV3gih3H6J1VjgQp3Rpb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 428	1508	rundll32.exe	83
PID 1508 wrote to memory of 428	1508	rundll32.exe	83
PID 1508 wrote to memory of 428	1508	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\LB3_Rundll32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LockBit-Black-Builder-main\LockBit-Black-Builder-main\LockBit30\Build\LB3_Rundll32.dll,#1
  2⤵
  PID:428