bced812112439dc85b04747045a0a19ee4b6d9f9ca0b378390e41379ffdb9f9d

Analysis

max time kernel
253s
max time network
260s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 12:11

Target

PvZ_Tools_v2.7.3/imageformats/qico.dll
Size

24KB
MD5

6d490833a4bedf9c53d98354f7020363
SHA1

34cd535c3c94d05011571070ce58da7ef37ae995
SHA256

a487943b5542e6ca2dfe7feeb9d9e71817c79f79b5c8f857ad4703a95a2c6c77
SHA512

2f74398a7e25c01bc49e1d9957f35675748fe97982a88265e37589c7c2987b6adf016494041d98b160db152c8223b6433ce9401d3ba7fa764e8602722dd881b2
SSDEEP

384:48a2KDpQie6r+Tx2DU/iNPljvGzjtq8bIqEeSisTHbkJ6posF:48a2KDpQk6x2FPMzI8bIpirJ6posF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 1308	3612	rundll32.exe	82
PID 3612 wrote to memory of 1308	3612	rundll32.exe	82
PID 3612 wrote to memory of 1308	3612	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\imageformats\qico.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\imageformats\qico.dll,#1
  2⤵
  PID:1308