9814a8f9f29e6efb4a7896f61ced334cc5567c3aa61a66325eca76360f1226b4

Resubmissions

28-09-2024 07:53

28-09-2024 07:50

28-09-2024 07:38

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 07:50

Target

level.dll
Size

789KB
MD5

4b393812c9241e1c77eef7c09ce1e1d9
SHA1

6139ef7bb6c9b0b48bedd755917e7944483e54c4
SHA256

9814a8f9f29e6efb4a7896f61ced334cc5567c3aa61a66325eca76360f1226b4
SHA512

a55206bf2df1ee322bbede2dd738fb67f2672398cc4289c5a5a63c76105dabf9633c9126d72a65110ff8a1cda7210371ead704d8027c7bd13ebc5078811ea508
SSDEEP

6144:GhQd+ZW/3TvUCWysU2XN92nIMkS9yjygIL1ZaquKIwsjd5vRukMi/mf+0Hlqn//P:sEv9yjpIrH6BjfEkPmt+/bYujcpZ

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 3488	644	cmd.exe	108
PID 644 wrote to memory of 3488	644	cmd.exe	108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\level.dll,#1
1⤵
PID:3176

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\system32\rundll32.exe
  rundll32 level.dllscab /k haval462
  2⤵
  PID:3488