8244d3c049d38b92198166cd4f16d6a77f67c731fd157683c25decf4e699867e

Analysis

max time kernel
137s
max time network
318s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
16-04-2024 19:36

Target

$PLUGINSDIR/InstallHelperPlugin.dll
Size

2.7MB
MD5

64f5c4568fb6c25a8f92a59e511423b0
SHA1

b606d12fe7b26d2f308c5fad6628b46c3221e821
SHA256

656ef52a9787664370e89e7b9e967300b3b1e65a8409058ac608720fb6adf752
SHA512

80590d5b94031368857d6a3ba8f25e94b9a26f6dc5f44bd221870b714d5675205b4fb05d3ea2e5820abf654fd274e8f98e3bb22801d9305d75f134a610ef835c
SSDEEP

49152:GM6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwY:V666666666666666666666666666666V

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1048	1692	rundll32.exe	80
PID 1692 wrote to memory of 1048	1692	rundll32.exe	80
PID 1692 wrote to memory of 1048	1692	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallHelperPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallHelperPlugin.dll,#1
  2⤵
  PID:1048

memory/1048-1-0x0000000000990000-0x00000000009A2000-memory.dmp

Filesize
72KB

Download
memory/1048-0-0x0000000000990000-0x00000000009A2000-memory.dmp

Filesize
72KB

Download