279fcb2ccefca844fcde2a93a4b81e34344b5f7d42a535e62e32df9158b23657

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 12:16

Target

$PLUGINSDIR/RCWidgetPlugin.dll
Size

1.2MB
MD5

e9aabbf2f13cf1fbedbac381c6ca1c1e
SHA1

1196443bb6db4b56b6053e3bf3d8b76665228675
SHA256

fb7fbf28f4835dadc5da29efddda761e8019554027b775de6bae8977a2bd5324
SHA512

b1d6a6a4a8a2e0f4d3f3b8ba7c7abf984ac3838c6d62f3f898465660b3a1343703a4b0ebf50dc966511cf8cdb2dacc6b507b382a4fd76ed238a3a1e2d4656ef7
SSDEEP

24576:EO5f92F7+Pn7pToiB2vE65mElzaG3Si/UsacJS6eBjhC4AQ2ejIfxvQkY/3J:lPLB2vEIHaG3H8thsecI/3J

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RCWidgetPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RCWidgetPlugin.dll,#1
  2⤵
  PID:2924