961bf55f25103eeb23ae7f6d25ea26f57eb23ebd521ef5c7397f50aeac37ac8d

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 20:04

Target

RSSReader_plugin.dll
Size

362KB
MD5

c77745740c3823c6bcfec35327a630bc
SHA1

d1d49cc042f4b4e8cd5466008643a893947d9127
SHA256

c665399f65111393c015814ef0ab9c8cb2215e048fa8d64c52e94c3ebb7a5eec
SHA512

80f492caa1c86f3a0944ae6cd6daf48b165cff3336e4dafa38ec9ea5ffe737731b65a7d94329c0fe04ee9865598117dc984c140408846f169721f26a845f4732
SSDEEP

6144:geOPipxlbzFYDIWBd1xhp0vll5tUFGhU17Qvz+fj2li/siabzC8gysQvKHXyU5fX:gxipxlbhYDIWht036GhU9S+b2w/9h

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1884	1044	rundll32.exe	28
PID 1044 wrote to memory of 1884	1044	rundll32.exe	28
PID 1044 wrote to memory of 1884	1044	rundll32.exe	28
PID 1044 wrote to memory of 1884	1044	rundll32.exe	28
PID 1044 wrote to memory of 1884	1044	rundll32.exe	28
PID 1044 wrote to memory of 1884	1044	rundll32.exe	28
PID 1044 wrote to memory of 1884	1044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RSSReader_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RSSReader_plugin.dll,#1
  2⤵
  PID:1884

memory/1884-0-0x0000000000200000-0x0000000000240000-memory.dmp

Filesize
256KB

Download