8204750ee2bb440abebc3feecddbcfc70ad485f7e741aac2cbc3708d8b2cab7a

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 11:05

Target

misc/liblogger_plugin.dll
Size

30KB
MD5

f544298d544ae0f17a0dcd95d6d1b658
SHA1

6e27d28b17355e2dd134808032d32ef1bd3ddcd5
SHA256

fab87920f675b6c262e566370e6a6a0b7bc7ee0d737947f36652bff6d6a1e1de
SHA512

9d7f4e49e4e0fd9f24354dd1a0b7c0d7e08725507e4b6b6971f003797084eb558fc22159d8a8609611fd0e604252fa3d361f65eced78558d6a6fa66b875b3f8a
SSDEEP

384:eHcQtcOoIilMWubY1d8mXAfqbuIDnvDGjoe0gh5vDGjoe0ghb23q:tXdMXU12mUq7DGFhVDGFhb4q

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 1996	4240	rundll32.exe	86
PID 4240 wrote to memory of 1996	4240	rundll32.exe	86
PID 4240 wrote to memory of 1996	4240	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\misc\liblogger_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\misc\liblogger_plugin.dll,#1
  2⤵
  PID:1996