8244d3c049d38b92198166cd4f16d6a77f67c731fd157683c25decf4e699867e

Analysis

max time kernel
84s
max time network
206s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
16-04-2024 19:36

Target

$PLUGINSDIR/SecureDNSPlugin.dll
Size

2.1MB
MD5

ac9d241925b41bf7d897487a1c492bdd
SHA1

b592973b90fde9854695e639c7c06d7416043ef8
SHA256

cfc7f0a6ca334c46f72c97cfc578619eb615912d7fcd83ed05532d6dcb1baf98
SHA512

7923a3af06c438972d4c9c91fb03d9ed9cfc93f9116a8fff2eaed9d2807495b501cbb7aa7ed177d22826810f1a63627e54948ed996c10d9e58931b2104d62e09
SSDEEP

49152:Tv4n/OcMUs1Zp/UVA8cfs21J/w3aoFVLgOvBarCep+Ch6LXT9Sc6KRj9fU3S7:Ob+8cV1JY3aapgO5arCe9h6LXTcc6KRb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3476	1032	rundll32.exe	80
PID 1032 wrote to memory of 3476	1032	rundll32.exe	80
PID 1032 wrote to memory of 3476	1032	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SecureDNSPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SecureDNSPlugin.dll,#1
  2⤵
  PID:3476