15d38a01c168d7a82ae39f5ffbbdd0cf482d53f2d54b747ff0d936395a016583

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 07:28

Target
$PLUGINSDIR/SogouPY.dll
Size 4.9MB
Sample240509-jaslasae98
SHA256 29a7c9c9f2399827c4ae67a62c414750e8ce26b46103dac3db5dbc17c4559716
MD5 67878eda87845d76dc5cf786568c3b5a
SHA1 1c190bcac6dfb8fa7bf9cb3d65fbda5a679db21b
SHA512 53b42078098788d7f4f66779946483aafa0711459daca4905b0e9a6286175aeeb109b8a8d528b9c59622162b249bd961a11c9186c07e76946007f5b9605e58e0
SSDEEP 49152:58nRUi+g6jbcNvrmWpqpSJn7CqSw18eS4d7OE4WrWRTXOGfTixiia+TQZLtC:+n6j4PpqK7piyBO9WrWRTXT+OY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4240	216	rundll32.exe	84
PID 216 wrote to memory of 4240	216	rundll32.exe	84
PID 216 wrote to memory of 4240	216	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SogouPY.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SogouPY.dll,#1
  2⤵
  PID:4240