fa708dbd323666bef72779702e67ea18192727f8d881ed8cd295619b892e6f1b

Analysis

max time kernel
142s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 11:52

Target
$PLUGINSDIR/oaolxjpjc.dll
Size 26KB
Sample240329-n1rtxagh38
SHA256 7c818c689d9194c90a1ecdd7838cd59ff216971cad20caf8e091d9fa48c7f3fe
MD5 fb556c16d4ab04252f71268c986a5c43
SHA1 5d8857c0fa4543642286072337af96d8374494a9
SHA512 adbfaf25b5937b934dc920436492faab186f0d5a64a57cb027da88a2c9fb4c8b65740713ff232400a908729ae4a48360a2ba79cce86237b9a79d2a1d840d7fc6
SSDEEP 384:c7QyMXLM36Y6rHgIM16z5o8r3MuCjswdAKkmwX:cEBLCUDk165BmJdAKkP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 1208	3980	rundll32.exe	84
PID 3980 wrote to memory of 1208	3980	rundll32.exe	84
PID 3980 wrote to memory of 1208	3980	rundll32.exe	84
PID 1208 wrote to memory of 3696	1208	rundll32.exe	88
PID 1208 wrote to memory of 3696	1208	rundll32.exe	88
PID 1208 wrote to memory of 3696	1208	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\oaolxjpjc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\oaolxjpjc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\oaolxjpjc.dll,#1
    3⤵
    PID:3696

memory/1208-0-0x0000000075430000-0x000000007543A000-memory.dmp

Download

memory/1208-1-0x0000000075430000-0x000000007543A000-memory.dmp

Download