a347e0709c0f0d266b7c2b6f6e4f453a3d18caac5a3a27242fe9112a011ed035

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 18:16

Target

$PLUGINSDIR/Kill.dll
Size

44KB
MD5

21dca3337d057710894909c4b709d65b
SHA1

9b7f9b4e203bbdf97df320d625e2569f99102289
SHA256

2827ef697ead9db2552f3a3fc597630727fc96f64ce3f71ae86230de4c9dcfe7
SHA512

ded36801e0566ba5c09baf70b2633f54e27d47103d7248f1e607acea82d0fd1aaa9bf1b82b7aa70572b2923e6b5bdaf85b8acb18f8df2e5300198047a57e3a8c
SSDEEP

384:6e3If6T5WyP8cb+JNQKSeVCj37K+BBOENoy5JY/GY8AuO5USPdvlfRatruXRRS:CCT5Wwl+rfVS3JvoA+GY8AlFvlftX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 3276	3812	rundll32.exe	71
PID 3812 wrote to memory of 3276	3812	rundll32.exe	71
PID 3812 wrote to memory of 3276	3812	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Kill.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Kill.dll,#1
  2⤵
  PID:3276