8204750ee2bb440abebc3feecddbcfc70ad485f7e741aac2cbc3708d8b2cab7a

Analysis

max time kernel
150s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 11:05

Target

mux/libmux_dummy_plugin.dll
Size

31KB
MD5

1cd2034baf0d90f52ec240364ef0d1a3
SHA1

c1a24570c350ccd53901f0f9e03d2b12f1e26001
SHA256

c84fc24a9d2537135352852521e6c153329e745bdfc339e19362df10a43babdd
SHA512

c45ec5a356ceb90a9831bb667173c04d45ffdf1454740b16f32bc9e86dd8e65ff233c53dd7d057be689535080ad0aac5f03ce4ce340416b6251f0e772a2146a2
SSDEEP

384:6jtmRjx0og3s9u8JXVQVeuxP7bvDGjoe0ghvLvDGjoe0ghym:kmRjP8+TJGVlPPDGFhvbDGFhym

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 728	4320	rundll32.exe	85
PID 4320 wrote to memory of 728	4320	rundll32.exe	85
PID 4320 wrote to memory of 728	4320	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mux\libmux_dummy_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mux\libmux_dummy_plugin.dll,#1
  2⤵
  PID:728