fa09d24d7481dbdfc1cff6aaa92d2aec908e037a22a02346f6feeee5d6ba688e

Analysis

max time kernel
138s
max time network
128s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
19/05/2024, 15:21

Target
Plugins/Freeform/wacs/freetype/freetype.dll
Size 836KB
Sample240519-srcqvach2z
SHA256 48e134e525a3503e1f61e6893ccc9c092d5ba741bb2e24271a08cdecfaf4e891
MD5 9fe9e011bc12d947e94d2af771ba73fa
SHA1 6238fe33f93469eae1a765cfeb73390ac1ffcfb7
SHA512 32f8cb072583556f9076f0ae5ef3db2a17a9b1bff6b702856250361c7db4d5a4625f72b6ec0936c597300454ca8d4fd1e87b493bf6d087c1cbcce6cb75dbdc00
SSDEEP 24576:bHhKq8nysh9XJc4oE/sgeL6AMN6ApXqbcZmHAQ:YqE5NsgM
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 3328	4612	rundll32.exe	81
PID 4612 wrote to memory of 3328	4612	rundll32.exe	81
PID 4612 wrote to memory of 3328	4612	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\Freeform\wacs\freetype\freetype.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\Freeform\wacs\freetype\freetype.dll,#1
  2⤵
  PID:3328