26f577e37ae6ea65acf5f454c439fd7adcd0491380bdc683ae84d34e654ea9b9

Analysis

max time kernel
154s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 01:14

Target

$PLUGINSDIR/SoftwareLog.dll
Size

528KB
MD5

598874bf53b926a1d418c64deaeac94b
SHA1

8ec0f8ac0dba8c73d0bf05b9190211acf69db9ad
SHA256

bc49f746555fd55515f85f469fe8f34aa5a93ff5fff473ba6f841ca15a6ddd89
SHA512

3c519093f0742f2e820f5fb7d069fb3758fccdbd654502a41b19926dfb514f27d5df3a5f9284b99016dfa999e63b76c7e0ff3746bdc0ce644803a4caea34655b
SSDEEP

6144:AgIdu8Z+ll7VsmuHMWzWr9Vz4Ob6kIRkhTS1WKrYd4cVHUez3qJowZVhP:A6RbIE9Rr6/UTS1WKrYqE/exP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 2424	4560	rundll32.exe	88
PID 4560 wrote to memory of 2424	4560	rundll32.exe	88
PID 4560 wrote to memory of 2424	4560	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SoftwareLog.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SoftwareLog.dll,#1
  2⤵
  PID:2424

memory/2424-0-0x0000000074AC0000-0x0000000074B7A000-memory.dmp

Filesize
744KB

Download