8e86e10a9b3a48604514c4fab81a68afcc48d1cbcf932255afdc8ca85e33c12d

Analysis

max time kernel
254s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2023 04:26

Target

PvZRT_Data/DRPC.dll
Size

861KB
MD5

0aa331b547d0650059a75dbad66248f6
SHA1

df01d62ecb2d263c80248c144d0b6212c0910767
SHA256

5e7c4bcc7b722179ca5de3933d0e807d0d1630d8e5a0a51b98cce85199051ea5
SHA512

9f4c0917cf39676c0c7145a21f1349d8ba981023a8c33990cf4046e852824a76ebab89371065ba546376fed95eeecf0accdbbf8fa99935ff4cb4622086c219bb
SSDEEP

24576:vnKXGOuXtgFPNnL5tj112jGLF2eoRdDyLI3QALP/z2Ji0Kj3BmsdeAnQ:vpVsPJL5tj112jGLF2eoRdDyLI3QAf2t

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 1380	4056	rundll32.exe	82
PID 4056 wrote to memory of 1380	4056	rundll32.exe	82
PID 4056 wrote to memory of 1380	4056	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZRT_Data\DRPC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZRT_Data\DRPC.dll,#1
  2⤵
  PID:1380