41981d5a3cc992589d944d6cf279a48f72c99c360a7aac705b40ce1e97a284a3

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 21:37

Target

$PLUGINSDIR/AnticareMsg.dll
Size

40KB
MD5

0ab8dd4d754ee97df55dfefbc0836627
SHA1

c5a2065ca4750c3246d96e2f740387faaad70c3e
SHA256

e84362455ac00ade7f45c58485533d3a7cebf5bb0fa1d4081b6e375ec1e7f788
SHA512

2a83535f31c1dc5f861d6d7cbe78a92684b91653df1260b78cfc7bbc54c2c9448a491083d5b9b4ffd03cbc057217c4bd8e0e989a4a3a992bad2cc838bd0d18ba
SSDEEP

384:aP4rbSlT57iuBjR6cC7Xx4r7ruc8/l3jyuhSvr1OWuf+cA/8oPdZO:HyTBiufqx4r2RjrSz1OWj/8oS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2864	1760	rundll32.exe	85
PID 1760 wrote to memory of 2864	1760	rundll32.exe	85
PID 1760 wrote to memory of 2864	1760	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AnticareMsg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AnticareMsg.dll,#1
  2⤵
  PID:2864