040a1381528d9ca2d668c8d795256bf924aa8ccaed7f895cb46e763e9fb09d43

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 12:21

Target

$PLUGINSDIR/poco_plugins.dll
Size

124KB
MD5

ae80cb665558ac0bdf0206d56ba9f5fb
SHA1

19413fc0c1ce884ec63988923ac053fd3d0d1c9f
SHA256

7c3f1d572cb12bc69923d72f4effbc88e749430c11b8662532c464c69df9e16d
SHA512

9c2bff34eaf0daa4a3c448a894bb54baca98cdacec47e322dbc0ca4ddf81b99a9e6d8434bf25ae46826ae3179e6f5c67e2cb439f9da64302e6ed11b9910d4e37
SSDEEP

1536:KqynFGsPoYp9TQvv78x1+nPYKyetPcpxmko7oTiA/DVkPPTdtwtDrWn:TFswq6Yx1qgMyKPYtDrWn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2792	2308	rundll32.exe	28
PID 2308 wrote to memory of 2792	2308	rundll32.exe	28
PID 2308 wrote to memory of 2792	2308	rundll32.exe	28
PID 2308 wrote to memory of 2792	2308	rundll32.exe	28
PID 2308 wrote to memory of 2792	2308	rundll32.exe	28
PID 2308 wrote to memory of 2792	2308	rundll32.exe	28
PID 2308 wrote to memory of 2792	2308	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\poco_plugins.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\poco_plugins.dll,#1
  2⤵
  PID:2792