ad272132970772ec9c1cf693f5aaee542a68c0f849d1b2eaaeebd0abf78e567a

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 06:57

Target

PluginsAndCOM/Plugins/Demo/DemoPlug.dll
Size

200KB
MD5

9024c60bc32ad5b737b567d2076aebd9
SHA1

2183ef7959d9d3c6157208bc2d1850a3c7cd4c7b
SHA256

827d22fa74e296c537ad886d5fddeb6d029b2740c3eea40c938a35dd7ab94a4d
SHA512

5e8c44c1b9f00feb00df64ef064dde2fe0ca4939baf99fb5475225c1f5e8c7cbafd7cd6fe885932ad0b12e9782f8b65208706982f8c88013d1a597475760edae
SSDEEP

3072:Zdz8pxd6Ln9ZjMOOEIEyQ8df/NuEjRZDGKxj1IR1gFzqXq2Y0HKDw7aqLnE1oOSH:uxd6D7PXSdf/Y2Saj1IRYzqrqkzE1t

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2212	1904	rundll32.exe	28
PID 1904 wrote to memory of 2212	1904	rundll32.exe	28
PID 1904 wrote to memory of 2212	1904	rundll32.exe	28
PID 1904 wrote to memory of 2212	1904	rundll32.exe	28
PID 1904 wrote to memory of 2212	1904	rundll32.exe	28
PID 1904 wrote to memory of 2212	1904	rundll32.exe	28
PID 1904 wrote to memory of 2212	1904	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PluginsAndCOM\Plugins\Demo\DemoPlug.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PluginsAndCOM\Plugins\Demo\DemoPlug.dll,#1
  2⤵
  PID:2212