97f316b567be836f302b4182037f02e17e2a8272534ce830a3d1d2ea15237006

Analysis

max time kernel
53s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 10:52

Target

$PLUGINSDIR/ProcDll.dll
Size

1.4MB
MD5

b7b3a4ef4a8592e6e7b39738ea411338
SHA1

f7bce9ad6fefa1ddf2ed078488091931d44ba146
SHA256

e89009adf98a1d946c11331be5068a71861608d39bb424bd9eab6a8216d742ee
SHA512

6a1f75c1f4fc273fa67de1280b692de28e6b1e39dc2f8f4d1db4638209ed73f60c3723fb008380f1d2a25fa824aaab85ec84f2e1a6bcd3a9c9fe7cdd0625c9b9
SSDEEP

24576:KWJ+BcHkaMM/X7SqNAm6ZIqUaAAMivtP0BzprKltFcuqDEC5yLg/2iSN6UvSWLRl:sBcjSDfkivtPktKiILgpiSWLR4A

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2228 wrote to memory of 1656	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 1656	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 1656	2228	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ProcDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ProcDll.dll,#1
2⤵
PID:1656