557c52ce5b2287387b843a22af6e4b84b200f67e4c869a7812f713b050d73f9a

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 11:04

Target

$PLUGINSDIR/KillProcDLL.dll
Size

36KB
MD5

6958016193a066833556992077bad4fe
SHA1

5f564945936f99381d7e2408f034f97d069005a4
SHA256

f38c669c87f2a73768a27a01622690997e9d93d5ca3830b349bd24c3ff9f8d2e
SHA512

fd6ab5c341b331b80c940ba97a2cd14547c796933a2df26d3dd87ede1602b86d9f8c37baebd7dd4c68d811199fc96a27ad4cb995bb8889d51af91db9f43ba0a7
SSDEEP

384:IL6T2Izs/XGCanZSwEfj5lwTSYlml89oayKA15JiQNRw/9uosAUdJofiiqd:88Y9gZSwq1lwTS2XA15DRm9cddJo6l

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 3036	2512	rundll32.exe	28
PID 2512 wrote to memory of 3036	2512	rundll32.exe	28
PID 2512 wrote to memory of 3036	2512	rundll32.exe	28
PID 2512 wrote to memory of 3036	2512	rundll32.exe	28
PID 2512 wrote to memory of 3036	2512	rundll32.exe	28
PID 2512 wrote to memory of 3036	2512	rundll32.exe	28
PID 2512 wrote to memory of 3036	2512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KillProcDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KillProcDLL.dll,#1
  2⤵
  PID:3036