140fdb598e8801d30a96fb91ba4fceb739f2a972199faa7c58ed7661bedc296d

Analysis

max time kernel
91s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 04:45

Target

$PLUGINSDIR/webapphost.dll
Size

1.2MB
MD5

fbf0dd519d216785212343c6f3116854
SHA1

70110c8e5e7c527e8268d48c807537509ba48dcb
SHA256

2fdb6f20615adcee9a0b77bf9b11597749d7eef352b8b1bfe1aba51cc9f2812a
SHA512

2ba1e191879c7ad7770bcc36fb85ba357953ccd86dee8347f32a177eadd96fb5ee01cadc2bdeed84a4a61869d4f3c91bcfca7103488820003e13133f277b04b6
SSDEEP

12288:3GVxBTf6B7JOXp5MLAxGSrzxavdcgKE9v/fomZCmMdwFsxcZrnuwtqPjlPXXFc:kAmbt8WgKedZCmMWs6ZRtqPjlPXFc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 3812	1000	rundll32.exe	88
PID 1000 wrote to memory of 3812	1000	rundll32.exe	88
PID 1000 wrote to memory of 3812	1000	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\webapphost.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\webapphost.dll,#1
  2⤵
  PID:3812