60c4175e18abf22d705d855abb6f16e08b80b9fb829a08589b9e4ba750c47349

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 08:06

Target

$PLUGINSDIR/nsRestartExplorer.dll
Size

72KB
MD5

56331af76ad6b4bbc2be2904c0bd3d43
SHA1

fdfe052c5260d0be9a00d089d4482b2b3672cdc4
SHA256

406dfe5b074bf8966ccaa6702e059e557aab4c1e6869db443d92d36701b65fd5
SHA512

f87652d87e3ba754d97a6579f545190c0efcb28fc89d65600a4b1c5ef14580b20d59f058c0b407cf38ee230f44f61c40ac7ef06fbd0a7284ce94c6e0121ee8ce
SSDEEP

768:LxQMGsApA1qcgVWHjurbI5zr99IV+e6GbG/3UspOb/eQt6eZHtQGCkO:WFsApAttcyz40D3UuObXZVtXCk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 1628	3808	rundll32.exe	84
PID 3808 wrote to memory of 1628	3808	rundll32.exe	84
PID 3808 wrote to memory of 1628	3808	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsRestartExplorer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsRestartExplorer.dll,#1
  2⤵
  PID:1628