8204750ee2bb440abebc3feecddbcfc70ad485f7e741aac2cbc3708d8b2cab7a

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 11:05

Target

misc/liblogger_plugin.dll
Size

30KB
MD5

f544298d544ae0f17a0dcd95d6d1b658
SHA1

6e27d28b17355e2dd134808032d32ef1bd3ddcd5
SHA256

fab87920f675b6c262e566370e6a6a0b7bc7ee0d737947f36652bff6d6a1e1de
SHA512

9d7f4e49e4e0fd9f24354dd1a0b7c0d7e08725507e4b6b6971f003797084eb558fc22159d8a8609611fd0e604252fa3d361f65eced78558d6a6fa66b875b3f8a
SSDEEP

384:eHcQtcOoIilMWubY1d8mXAfqbuIDnvDGjoe0gh5vDGjoe0ghb23q:tXdMXU12mUq7DGFhVDGFhb4q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2564	2352	rundll32.exe	28
PID 2352 wrote to memory of 2564	2352	rundll32.exe	28
PID 2352 wrote to memory of 2564	2352	rundll32.exe	28
PID 2352 wrote to memory of 2564	2352	rundll32.exe	28
PID 2352 wrote to memory of 2564	2352	rundll32.exe	28
PID 2352 wrote to memory of 2564	2352	rundll32.exe	28
PID 2352 wrote to memory of 2564	2352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\misc\liblogger_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\misc\liblogger_plugin.dll,#1
  2⤵
  PID:2564