e2cadb0766cf2fc20a527c917f4475388ef3fbd73b8e0c6d071b695afbb1dba3

Resubmissions

04-07-2024 17:22

04-07-2024 17:19

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 17:19

Target

[DemonArchives]c30111080c9e6acc70dd86ff97188ac8.dll
Size

2.2MB
MD5

c30111080c9e6acc70dd86ff97188ac8
SHA1

5c02b64493debdbf0da3f4c6be86ea5ba46610a4
SHA256

581453bd1c1814aa96e9bab6d447a564ad5bb585ffdf663e9587bb680f594699
SHA512

619ea5ac1ad905f9466cf9c96ac9bf1057dd0499ab4bb17bf9b2d4c249daad2a2d806dc070f4d56bf684c6065a87e8e39f453d2126186aae6d998fa877bce1da
SSDEEP

49152:TJd0OM5Fym/AgJTYM97tQjFozL19wNa/Wgw:VCOM5bJqjFKp9JWgw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2380	2940	rundll32.exe	28
PID 2940 wrote to memory of 2380	2940	rundll32.exe	28
PID 2940 wrote to memory of 2380	2940	rundll32.exe	28
PID 2940 wrote to memory of 2380	2940	rundll32.exe	28
PID 2940 wrote to memory of 2380	2940	rundll32.exe	28
PID 2940 wrote to memory of 2380	2940	rundll32.exe	28
PID 2940 wrote to memory of 2380	2940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\[DemonArchives]c30111080c9e6acc70dd86ff97188ac8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\[DemonArchives]c30111080c9e6acc70dd86ff97188ac8.dll,#1
  2⤵
  PID:2380