06fd4d290117d8601ae557c494e43e6fa2edb48b796d51262aa77a862dbca1f7

Analysis

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 00:39

Target

$PLUGINSDIR/efoaq.dll
Size

120KB
MD5

c642b341e69cd35ca434cb5d046415b7
SHA1

b292770856b5689445a88b58fa2f9a477b4a1231
SHA256

5db3d75eeb1b3f5b2cc28c5ac0c13441f944d0095d212d06afd4aa5548708b9f
SHA512

e873ff5cbb711323560516cb581a7bb756f45828abb4f0c27605b07e98713e92ede29db772adac1fdaba078f48b8202a670b965d088a2b51f967b105d692bc0c
SSDEEP

1536:yhdeTMPViwLdiIuoV/E35+E1mmbfkRNn9RSLMPJFGrnaB3ZoJrMSfU:yaTO4IuwyhbydjJFGc3Z+ISc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1896	1716	rundll32.exe	87
PID 1716 wrote to memory of 1896	1716	rundll32.exe	87
PID 1716 wrote to memory of 1896	1716	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\efoaq.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\efoaq.dll,#1
  2⤵
  PID:1896