cddc7c774570b556d8d391203f8084e97850f3cee8a482a0c36ea74de348da2f

Analysis

max time kernel
125s
max time network
144s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
23-07-2023 22:52

Target

languages/en_XM/DevicePlugin - Copy.dll
Size

21KB
MD5

54b587560d4b45dd882f719dd4d89d2c
SHA1

c22c499d6e9010603d3dc565277d5a49b9b9bc14
SHA256

bd6f42acdf23085cc4140f5da6907c9de666d81d3d01c877e59f657adde43d2a
SHA512

025c0b37f708dd3b2062f4d54404617e86f55aeeb9fed86248dc507fbb9763cd4a9ce803fd750cf4d46dc7c9fa2fe0c0b1a9bf30dd9d95050fae9e128a6127b4
SSDEEP

384:6E5dRcdS5rHS8ru6Q6tfG7TfJRgRwdzPYPDONyNnYPLExZeM:rdR6Sl1cJKGYPoyNv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 1592	4416	rundll32.exe	70
PID 4416 wrote to memory of 1592	4416	rundll32.exe	70
PID 4416 wrote to memory of 1592	4416	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\languages\en_XM\DevicePlugin - Copy.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\languages\en_XM\DevicePlugin - Copy.dll",#1
  2⤵
  PID:1592