4823257b6e91618705a5f1459308365cd3392d2a5e9164e0318a5eee7173d717

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 01:17

Target

$PLUGINSDIR/SoftwareLog.dll
Size

528KB
MD5

c193c03622ba6c79e648e7fc148b7f1c
SHA1

393af664a45dbc998de7c66bb9920153c25812ec
SHA256

76c797752154767e5e53337ff34197dfdbd47b94b063df2577009c999a459171
SHA512

1e6a56294b593ffa60d693461ed9dd0259cb689af0c41a5c577fd88542f63b6b2dfd3647555c035eb1edf69ab8ea13665cc96aafc5de7508dab18592fd3d6673
SSDEEP

6144:ygIdu8Z+ll7VsmuHMWzWr9Vz4Ob6kIRkhTS1WKrYd4cVHUez3qJowZVhb:i6RbIE9Rr6/UTS1WKrYqE/exb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3168 wrote to memory of 4920	3168	rundll32.exe	rundll32.exe
PID 3168 wrote to memory of 4920	3168	rundll32.exe	rundll32.exe
PID 3168 wrote to memory of 4920	3168	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SoftwareLog.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3168

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SoftwareLog.dll,#1
2⤵
PID:4920

memory/4920-0-0x0000000075160000-0x000000007521A000-memory.dmp

Filesize
744KB

Download