005cc5fcee47af9761a6d41b5789683ad454ffa416a7bd7a9d3472ddf9fc230e

Analysis

max time kernel
92s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 02:47

Target

$PLUGINSDIR/RCWidgetPlugin.dll
Size

2.7MB
MD5

c8f4719f57485ede91c05335df4cc1b2
SHA1

895b4e75ee2e9f302351acb74c3c7936d32585a0
SHA256

72c2bd73e2915db5f490498f9cd4ece2f5fe2070b06d3fc7abcfce5a2fd9a101
SHA512

f8a37a969961a8299604a930f2b1834502b07baee042597d6a005ee1885a69c71e5cbc9d029209b20e8200b2e40eb4bc5b6ce865139d5ef702e2559d3bca3d09
SSDEEP

49152:L4W12DeELdPYW+1Upj3Oi+8PDwcX7LWifBLhhnXdFs9n20inrT3V/ul/hw0R25P:zwgwwcX7vBLhhnXdFs9EURhw0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 4688	4356	rundll32.exe	86
PID 4356 wrote to memory of 4688	4356	rundll32.exe	86
PID 4356 wrote to memory of 4688	4356	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RCWidgetPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RCWidgetPlugin.dll,#1
  2⤵
  PID:4688