8204750ee2bb440abebc3feecddbcfc70ad485f7e741aac2cbc3708d8b2cab7a

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 11:05

Target

misc/libexport_plugin.dll
Size

62KB
MD5

4a5d577b1b54e9b0a940deb5e31f8c92
SHA1

4bf6aa78a1fe9483b96cccdb5fc121fabf251af8
SHA256

ef2e7d96c497e9b1320bc9a722f6036c6f67e3867bc2e9ed2f42326dbf44bf6b
SHA512

2df61681e5d1864904d8b3807661731d76089edc5c227e8b232afacd41455389cbc51f860961a7b56c7ef3209f32acabb64840cb6e159f5b6a5111009c114c93
SSDEEP

768:5V0ZO/XfxBLxM6wuiCUmW32VeeWzloxYt+E4GikU2oxDhRgvCczVm6DGFhG8DGFg:5mZOh/wP3KiloTEZjU2oxDhRgvCczV8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2056	3064	rundll32.exe	28
PID 3064 wrote to memory of 2056	3064	rundll32.exe	28
PID 3064 wrote to memory of 2056	3064	rundll32.exe	28
PID 3064 wrote to memory of 2056	3064	rundll32.exe	28
PID 3064 wrote to memory of 2056	3064	rundll32.exe	28
PID 3064 wrote to memory of 2056	3064	rundll32.exe	28
PID 3064 wrote to memory of 2056	3064	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\misc\libexport_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\misc\libexport_plugin.dll,#1
  2⤵
  PID:2056