06c5de573d65dc8f4cfc9e3c4699b9b444aa1a5b40c05573567a882d4eb4fd46

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 14:56

Target

$PLUGINSDIR/korspjbs.dll
Size

121KB
MD5

51adc611be2ed1f83f3143a2f15ff60e
SHA1

47f32166422930c47e14c4f386f910d700121ed3
SHA256

4fcc808dcf3eac889fce16919bd4028aa2b8ade3478fc8ee8721efb01b9f354d
SHA512

b44b276cb03749cb2ddfb5a6ead0d693767af67646cb7294de4506de1f518110f75f5534211a734e9c1494d49eb378b29f004932b7761d2e0cf9b5c1121a6c51
SSDEEP

1536:qhiPbQ6UnOb5RJUcovgjEKimjCu5v4fX6LteTg6Cn2BJgZgo1ssMSCK:qhiPb7YOb5gOjxQmeTg6tJgZx1sfSf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 116	212	rundll32.exe	85
PID 212 wrote to memory of 116	212	rundll32.exe	85
PID 212 wrote to memory of 116	212	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\korspjbs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\korspjbs.dll,#1
  2⤵
  PID:116