05a27e21a0194e0b5ac0af3fe1ba6f6aa6866e874ab2fd7126421139ffb80c59

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 16:29

Target
Plugins/DiracLE.dll
Size 268KB
Sample240503-ty8brsba8w
SHA256 bb61ed1bf7e2b98e040c20936523bd9bd71ea2b546d6fa95ed51f1541a8910b8
MD5 93238672c08442d0fa2f41923e2c51cd
SHA1 98f97cbc1747a02d00116123425c45fbd86be531
SHA512 e013e3a7a25d1ccac6a4abd4980cb9e6a3f0637d7e3712d5a20e86841a338adde350a170aae978d8aec06d6764d5c018a8feb94f09e035b658f9a1b0683cb686
SSDEEP 3072:ZDkQ3hnmg5lalIXt6Wbtz+nFdor2gUbbzsl49oa/p:Z5Xt6qwFdor2gUbbzslo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 3564	3420	rundll32.exe	85
PID 3420 wrote to memory of 3564	3420	rundll32.exe	85
PID 3420 wrote to memory of 3564	3420	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\DiracLE.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\DiracLE.dll,#1
  2⤵
  PID:3564