Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-05-2024 23:25

General

  • Target

    ollydbg-script-master/MoleBox/MoleBox 2.xx Auto-Unpacker diy by:heiketian10/mbunpack.dll

  • Size

    147KB

  • MD5

    684150ba77ca90fa6fdf405a848b2c7f

  • SHA1

    ef3d69ea443b9b7d2742418a1207eea62b5d5500

  • SHA256

    3fa5d1235af2b53c17a7dce32f19f663e2bfb84efeffebb32f7285a5555335a8

  • SHA512

    c3c4972ead42383b646926ff422fe353b14c43ee01f235c544d44acb8b7dee7e4ff7a905d3fac70c62b7296e393dd06c7d68392313ec518b1a55fe95fc849720

  • SSDEEP

    3072:e0I29s4CurXqp83OPe8y5fDdHglgQHBhMN9EmygwYCDkx+Is8pGGW0:lHt1rapedRDdHgllbCFtwrDkZpTW

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ollydbg-script-master\MoleBox\MoleBox 2.xx Auto-Unpacker diy by:heiketian10\mbunpack.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4932
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ollydbg-script-master\MoleBox\MoleBox 2.xx Auto-Unpacker diy by:heiketian10\mbunpack.dll",#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3780
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c mkdir ".\!UNPACKED!" 2> nul > nul
        3⤵
          PID:4804

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3780-2-0x0000000010000000-0x000000001004E000-memory.dmp

      Filesize

      312KB