bced812112439dc85b04747045a0a19ee4b6d9f9ca0b378390e41379ffdb9f9d

Analysis

max time kernel
255s
max time network
262s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 12:11

Target

PvZ_Tools_v2.7.3/styles/qwindowsvistastyle.dll
Size

115KB
MD5

0270631ccef7123c7ca6fc67cea71547
SHA1

2bee5b23a394ee7e82787698bb10e77ef051bc88
SHA256

3a370657acc91cf180b2f0fd57acdb10e06f1472a98361766b1a4acf4667e879
SHA512

8f39ab1905b27a140e55a5a5fbc32e4c3a31c212f0c07cf6310e173be2251d0c04f14dcd6a4109fc1209afcee2e00b081bcf2df9aebf9255d44d3d2a6a879706
SSDEEP

3072:B7QFOzuIWZrflOwSofH3KX4AeL3Eg9BfrPIB3i:nm9nfXKX4AeL3Eg9BfrPI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2100 wrote to memory of 1928	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 1928	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 1928	2100	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\styles\qwindowsvistastyle.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.3\styles\qwindowsvistastyle.dll,#1
2⤵
PID:1928