343bcf3e6a6cfb2ba9011c8cb5215b4fe5c2f515734bef0979ee3d1de3c6e202

Analysis

max time kernel
89s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 21:46

Target

$PLUGINSDIR/TBC.dll
Size

94KB
MD5

ec0281fd243bffbfe3cf1558e99b51fc
SHA1

2841c1e42a06d618db54dedc9a5aee48c1c9869a
SHA256

902ce26a56b68e18f4360c7b6a3221757377af06e9125bdaeed8f1290d999659
SHA512

a117af91d786ef824f0b0f978cbc15ebc098f6b57481888d97f0ce503ce39e4a6312cd51ffe32625cbe8c4d019f5b40a4d796608c22eeb95d97150c57080d99c
SSDEEP

1536:ahu/kdI2gfoH4wL5T/WFxQG68gK4T765JXffhi4HUOk1m59bd9tgvpk:l+gwYET/sE7oXffhkmvbd9tgvpk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 3536	3992	rundll32.exe	14
PID 3992 wrote to memory of 3536	3992	rundll32.exe	14
PID 3992 wrote to memory of 3536	3992	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TBC.dll,#1
1⤵
PID:3536

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TBC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3992