17da20b574a032fe666b373e92704b10ee26f3ab0a2a1258336e5d0aa9a6c2c6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 02:45

Target

$PLUGINSDIR/Install.dll
Size

276KB
MD5

9d6dfc7dceb09ed2308447045ce7036f
SHA1

2b6fc09cfec4cd9be5e0ba546c1d84634df43d00
SHA256

e83136b0ad2ad660c0287cb2a6716442c69939b9ab4ccded54f2c7413d635cf9
SHA512

6836feeb029f66eb6e08a52aaed36f2341a7d5df71b253835d4a668992e8d62623b716b510c238b342964a2d54a63a90794e031db4f2df39d1a5ef62748acefc
SSDEEP

3072:2NvIiB+blSyhzMdlEiYion+x/KSEhESOxMYatkd79fW/Ut95hzJsSEexbwtcV4xx:QzbE+lEioC/KtRYatkztR19V+x

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 4264	3512	rundll32.exe	86
PID 3512 wrote to memory of 4264	3512	rundll32.exe	86
PID 3512 wrote to memory of 4264	3512	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Install.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Install.dll,#1
  2⤵
  PID:4264