bced812112439dc85b04747045a0a19ee4b6d9f9ca0b378390e41379ffdb9f9d

Analysis

max time kernel
257s
max time network
262s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 12:11

Target

PvZ_Tools_v2.7.3/libssl-1_1.dll
Size

442KB
MD5

4bd8c5f5a050450441cbc6ac6e64c086
SHA1

b5d83a131b7e0a9acc7c981260a6c8713b3a1d3c
SHA256

4fa1541ee02d1caf4eabe768433a2933eca2c1bc1641601e568db4382bc93b9c
SHA512

80879801922cdae8a9115c56f33789b480ac7e5fd1715c9686a0a1d02267a4c9eb91f63c3001970b670831e8312a675ed6c92939c1cde8daaca2bdfbdb5bd891
SSDEEP

6144:uGe5rN3seE4yS/d0Tyz4CEQF4IflpekG6ZeJrQr6Xh4U2lvzfY:5ebTE4yYdLjSKUxHQr6R4U2lvzg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4212 wrote to memory of 4044	4212	rundll32.exe	rundll32.exe
PID 4212 wrote to memory of 4044	4212	rundll32.exe	rundll32.exe
PID 4212 wrote to memory of 4044	4212	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\libssl-1_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4212

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\libssl-1_1.dll,#1
2⤵
PID:4044