8204750ee2bb440abebc3feecddbcfc70ad485f7e741aac2cbc3708d8b2cab7a

Analysis

max time kernel
60s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 11:05

Target

lua/liblua_plugin.dll
Size

365KB
MD5

d8e3049ad47748cfbe9e974489e4759e
SHA1

4ab04436825b064073ed9d35a8abc846e18ed432
SHA256

159e6eeef7d51afecae9f6857b3e23ccb952df75b8265953e45b90a2623e3835
SHA512

20b75a199dcffd30fbf9ae3e1e0a40b1dd7cf8ea41b54a80895bebf0d59414d6e0d1c1362445cd5f124eaf3f00a0bf4fcdb7a400382a27606e269b7f5605d043
SSDEEP

6144:ugriB4PHEJEsgNRfCpX0pK0bBOxk4hMJwQL+4eM5lw+Sh2fSeq:ugr+4PfRfCpgFbMy/J5L+RM5W+i2fq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1812	4956	rundll32.exe	85
PID 4956 wrote to memory of 1812	4956	rundll32.exe	85
PID 4956 wrote to memory of 1812	4956	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lua\liblua_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lua\liblua_plugin.dll,#1
  2⤵
  PID:1812