e0c875b2cb4762bb16896413eb5635615f7a98d68b3998491a0b4fa8da8f655f

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 22:10

Target

$PLUGINSDIR/MngModule.dll
Size

862KB
MD5

992ef262f488bd71005d04644b128788
SHA1

6a35e4ba677cc9e03fac85983bd968ab8862b16c
SHA256

ca89fab589e51e74468860dec0a63eaf4bb9a80a8444fde7783f43ec7b96916b
SHA512

6e619c4a2b382b2f7e9a9aab5cc9578caced894092cec9abd96fa9958a0506042afc463e1a767eece3115ed5db62d207b84df6dc919a84330cecf9309cb59578
SSDEEP

12288:fQD1kl1ZVQQNaA13/NY9+pQwqDeIGvKb2yuYNemSIWGJjrirC6B5LgZku:o+l/Njp/bTyuYFWGJjrir3Fu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 4496	2016	rundll32.exe	47
PID 2016 wrote to memory of 4496	2016	rundll32.exe	47
PID 2016 wrote to memory of 4496	2016	rundll32.exe	47

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MngModule.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MngModule.dll,#1
  2⤵
  PID:4496

memory/4496-0-0x0000000060900000-0x000000006096E000-memory.dmp

Filesize
440KB

Download