578524510fd4a84bf748b71584b550959b1ef91e9451478541c5e7561d8aa600

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 10:46

Target

PlugIns/CX_ContactSheet.dll
Size

382KB
MD5

c142c727897de19e0a51538464c5cc0c
SHA1

7bdd3bab2386aee44c0220c9ade48699679d65ba
SHA256

b4b584ac8cd07ec0bef553c35992663595221ceb88fdeb77c6d353725d2894b1
SHA512

4afa92b98e9a5ee830c9274af250f75a0336c5572107040d986aebf7b12bb46f3877d5dfdb375b1d23a5e66a6ac81d4edd8da1dbb05f5d60546baf626adec70b
SSDEEP

6144:T03On6rJALX73Th2V97d03TRNV4EH7lreYyI/lOeoxn4INC7Yh0UK1y+vXHlYycy:TSE6rJO73UsV4al65+sp4zYIU+GplTM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 60	3212	rundll32.exe	87
PID 3212 wrote to memory of 60	3212	rundll32.exe	87
PID 3212 wrote to memory of 60	3212	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PlugIns\CX_ContactSheet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PlugIns\CX_ContactSheet.dll,#1
  2⤵
  PID:60