5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 16:14

Target

Plugins/PingPlugin.dll
Size

86KB
MD5

9bfda79c3aee286817e1579b15579b9c
SHA1

07fb8d727ec0af97b684d51bf053239321a38c9e
SHA256

9558ecfd0df85b4865baf26cd984e29d53840307c00331638533ef4f2a184534
SHA512

e6cd7a2d8ab78b6c23655af07d3f0b283a0cfc572dbc415c2d9b0adc5f9f2baa1e56575c2ed50b08e90bcaf1d6dbecda5eac057eaaf9578d8d7e73e45194a9a1
SSDEEP

1536:6QStrsWVHcdhgFM6eI7Az4FzqRHM7JnNbtEVe0DjSoikQ9VWqToN:6QQ32hgCXI7ZulMtnEVeuc9VWqTo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 1464	4824	rundll32.exe	84
PID 4824 wrote to memory of 1464	4824	rundll32.exe	84
PID 4824 wrote to memory of 1464	4824	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\PingPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\PingPlugin.dll,#1
  2⤵
  PID:1464