17da20b574a032fe666b373e92704b10ee26f3ab0a2a1258336e5d0aa9a6c2c6

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 02:45

Target

$PLUGINSDIR/LaunchHelp.dll
Size

66KB
MD5

66fd0bb3adb4cbfc2cbce88d951455b2
SHA1

1ca5b9b322886165748223107a1676a82cb3b3b2
SHA256

0ac3ca465b41fe6af0ba88fe774c6e6a1b3424597f6f0807c0313e3d12623c7e
SHA512

a8a5ae3300cff3c155bfaf48734f60b3e0f5dc7883776fb1169ab171ecb6f5f2266dd67802ec029c2c32fc21189b4337671c4d5f13bd43771c627d66ecff47ff
SSDEEP

768:NAVPzAnhYtIvY/09Xa/k1ZfEkO9QNxhJOfLYwLgEnBC/tkeeXvAiOUEDInTUC3Kl:NGzrtIiMjHQfLYwLJnI/tkzF00S

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2120	1140	rundll32.exe	28
PID 1140 wrote to memory of 2120	1140	rundll32.exe	28
PID 1140 wrote to memory of 2120	1140	rundll32.exe	28
PID 1140 wrote to memory of 2120	1140	rundll32.exe	28
PID 1140 wrote to memory of 2120	1140	rundll32.exe	28
PID 1140 wrote to memory of 2120	1140	rundll32.exe	28
PID 1140 wrote to memory of 2120	1140	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LaunchHelp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LaunchHelp.dll,#1
  2⤵
  PID:2120