f8e7686e71f47f22f9b20f7c4fa19f833bac189fd586fab80427d7b60eeedace

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 01:36

Target

f8e7686e71f47f22f9b20f7c4fa19f833bac189fd586fab80427d7b60eeedace.dll
Size

37KB
MD5

63a2b7c801372de4e721fa5d089313e4
SHA1

d9a7ab0bf2a2fcbb20bf36c64c397e4bf5cb86b8
SHA256

f8e7686e71f47f22f9b20f7c4fa19f833bac189fd586fab80427d7b60eeedace
SHA512

222d1ce1416dbaadcf9e4963747dd6b6bc3cdad3eb6e3012c60df75252aa30b4690bd6f9ea91c96bce555d52159f40baa3d35920a9f765aa73de92293f703e6c
SSDEEP

768:HmfR/UF+ZLqRXxnXeklArwni9Nem3ovrQd0TmcQdLi0Ga/:sW+ZeRXxXdAre2em3+rtSjGa/

Score

4^/10

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\pluglog.txt	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 1224	1840	rundll32.exe	80
PID 1840 wrote to memory of 1224	1840	rundll32.exe	80
PID 1840 wrote to memory of 1224	1840	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8e7686e71f47f22f9b20f7c4fa19f833bac189fd586fab80427d7b60eeedace.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8e7686e71f47f22f9b20f7c4fa19f833bac189fd586fab80427d7b60eeedace.dll,#1
  2⤵
  - Drops file in Program Files directory
  PID:1224