156b80146ad1303272d8313690449ae9773a18c58af1ce0c2da33e59aadbbc7f

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 18:58

Target

$PLUGINSDIR/hug.dll
Size

120KB
MD5

723a2a8598c45c182aa68520343af9bb
SHA1

4f3562eebed639169e3c77669dbc2d5eb2cbe6e1
SHA256

cbae224828c16bfce4538f77b6817205f8f8e8ecb70373bb213849a015ed8ded
SHA512

cb97e8aa6ba0cf2c36df7bbc8134121bafcd581d2fffbd23f1c2c681dad8108a556024a52bb606e38466023ca9dad3302ff6ebb6baf469b220942f8565ec774b
SSDEEP

1536:FicHWOZV7VVLWzgT0SLFB4ZkdyOyiFQcrfv2KttjnjBiNZQ1MSD7j:ZWARjLWBSRd8Ab2KttZiNZQ2SDP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2352	2944	rundll32.exe	28
PID 2944 wrote to memory of 2352	2944	rundll32.exe	28
PID 2944 wrote to memory of 2352	2944	rundll32.exe	28
PID 2944 wrote to memory of 2352	2944	rundll32.exe	28
PID 2944 wrote to memory of 2352	2944	rundll32.exe	28
PID 2944 wrote to memory of 2352	2944	rundll32.exe	28
PID 2944 wrote to memory of 2352	2944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hug.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hug.dll,#1
  2⤵
  PID:2352