7d193ee636a32820be667d76f35258c087604539f5a52a442ba947339eb8ae58

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 16:08

Target
$PLUGINSDIR/dpzqzg.dll
Size 31KB
Sample240328-tle5fsad3v
SHA256 8a6442971a1c7f3ed896d6feebcdc009d71570a6a144ad70178c6123cc1d90ce
MD5 9bdddd9535bf57393703d05ec9dd555d
SHA1 d2ddba9150c10d60216ccd6fe87082d0babb9c84
SHA512 8643eb9d9bfc23f349fc7e8aa27f6b3e9783a52d819df9a76edfae3abb021c3a348eea0b6a77d4267df363fd2a758049eef4e9e10dba155c3e0eeaf38d915e86
SSDEEP 384:y8fNgOuCHP+Ang3eF+6Kswci/+9YFju5kKQHZ8Fz7cs2NugH7bVF4JtQ3sDLnDT2:1kpszi/1u2KQKZ7cs24gdF2tjPDTt
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2748	1696	rundll32.exe	84
PID 1696 wrote to memory of 2748	1696	rundll32.exe	84
PID 1696 wrote to memory of 2748	1696	rundll32.exe	84
PID 2748 wrote to memory of 2772	2748	rundll32.exe	88
PID 2748 wrote to memory of 2772	2748	rundll32.exe	88
PID 2748 wrote to memory of 2772	2748	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dpzqzg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dpzqzg.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dpzqzg.dll,#1
    3⤵
    PID:2772

memory/2748-0-0x0000000075220000-0x000000007522B000-memory.dmp

Download

memory/2748-1-0x0000000075220000-0x000000007522B000-memory.dmp

Download