92568303c5f9880d3c36c8f1e25516f1d51809598394fcc3b39f3cf36afd03d5

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 08:35

Target

LoggingPlatform.dll
Size

450KB
MD5

b54858b7357303dbd5582ea44abeeab8
SHA1

f3ba1d65f855d61dce13efbc42ce60ca8548a49c
SHA256

cc912e37802cd5c128c19949d4529e7d48266d67dd7b6dfedfd9c493d94cbe64
SHA512

b364ee1019e215c10030834cca4ca6436568e6ef25d2bee877b908bbf68f7c004559ff5317275b17c2f221c0daedbf50e11ec1bfe29c96cb61389cba75bb2295
SSDEEP

6144:q0l6+z17nzENTZ/1qZ9RQK7L342eaSmJDmPSvnjxQKhqOHTqnxm1Y3ki09t+mbTN:ayqJoZ9382tDm6vG1xDaLpJ//rpd

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

FileCoAuth.exe

pid process

3448 FileCoAuth.exe

pid	process
3448	FileCoAuth.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2428 wrote to memory of 2204	2428	rundll32.exe	rundll32.exe
PID 2428 wrote to memory of 2204	2428	rundll32.exe	rundll32.exe
PID 2428 wrote to memory of 2204	2428	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 3448	2204	rundll32.exe	FileCoAuth.exe
PID 2204 wrote to memory of 3448	2204	rundll32.exe	FileCoAuth.exe
PID 2204 wrote to memory of 3448	2204	rundll32.exe	FileCoAuth.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LoggingPlatform.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LoggingPlatform.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\users\Admin\appdata\local\Microsoft\PlayReady\FileCoAuth.exe
"C:\users\Admin\appdata\local\Microsoft\PlayReady\FileCoAuth.exe"
3⤵
- Executes dropped EXE
PID:3448

C:\Users\Admin\AppData\Local\Microsoft\PlayReady\FileCoAuth.exe
Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit