7d95f2dbdfffd9227cc5832d6ee21c385a18c43b4155edc3a9fc1d988c63bf78

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 14:18

Target
Rebel/Bin/Rebel.dll
Size 8.6MB
Sample240824-rmlmhstfrd
SHA256 c9b95b9204234edfab46912d21953e3a6985a6b7d50c4fd63372e3d5361c7f3d
MD5 660d2429fc5f088bd197fb0958303936
SHA1 4189d1ba115f9e00caceb286f22655c6988e1eb6
SHA512 9875fff045460f77dfc21cecd1de326d67778efd12fe8f53fc09bacfec807a9309752ed4bbb23653060fbee9152dd7c9a9bfda3a0c13c0375a1db932a02a197d
SSDEEP 98304:kz+S5QwKbQLCsjIpdUqsQf3/sfRMyxl5dn5Sz29f49EzFgfVp+t:WrS2LXjIpyDS3/0aWfmC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2524	1788	rundll32.exe	30
PID 1788 wrote to memory of 2524	1788	rundll32.exe	30
PID 1788 wrote to memory of 2524	1788	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Rebel\Bin\Rebel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1788 -s 104
  2⤵
  PID:2524

memory/1788-0-0x000007FEF5170000-0x000007FEF5A03000-memory.dmp

Download