1b286678c8cdc68efc2c36261d6d898c456e24ce5fcc9e881423ba9402849037

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 23:25 UTC

Target

ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by：heiketian10/mbunpack.dll
Size

147KB
MD5

684150ba77ca90fa6fdf405a848b2c7f
SHA1

ef3d69ea443b9b7d2742418a1207eea62b5d5500
SHA256

3fa5d1235af2b53c17a7dce32f19f663e2bfb84efeffebb32f7285a5555335a8
SHA512

c3c4972ead42383b646926ff422fe353b14c43ee01f235c544d44acb8b7dee7e4ff7a905d3fac70c62b7296e393dd06c7d68392313ec518b1a55fe95fc849720
SSDEEP

3072:e0I29s4CurXqp83OPe8y5fDdHglgQHBhMN9EmygwYCDkx+Is8pGGW0:lHt1rapedRDdHgllbCFtwrDkZpTW

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 3780	4932	rundll32.exe	83
PID 4932 wrote to memory of 3780	4932	rundll32.exe	83
PID 4932 wrote to memory of 3780	4932	rundll32.exe	83
PID 3780 wrote to memory of 4804	3780	rundll32.exe	86
PID 3780 wrote to memory of 4804	3780	rundll32.exe	86
PID 3780 wrote to memory of 4804	3780	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ollydbg-script-master\MoleBox\MoleBox 2.xx Auto-Unpacker diy by：heiketian10\mbunpack.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ollydbg-script-master\MoleBox\MoleBox 2.xx Auto-Unpacker diy by：heiketian10\mbunpack.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir ".\!UNPACKED!" 2> nul > nul
    3⤵
    PID:4804

No results found

memory/3780-2-0x0000000010000000-0x000000001004E000-memory.dmp

Filesize
312KB

Download