8c9e31e716cc7ab5de246976e9d6a683233e97688e627d3d9202f096aa598af2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:51

Target

$PLUGINSDIR/RCPicPlugin.dll
Size

976KB
MD5

983a34463e33a15a9c07fabfd1e1d20b
SHA1

27ccc9224021ba5dde0745a9e37cdf938bb04090
SHA256

d486b6ec021008a0fe0bc90938590544add1dc35bb839eda3e01084069a96e07
SHA512

9dfcad69b468ab38eac0994e195034e4095d1a91cdeff96f1e14d0f9daff052659b88af65212ea85f209d1b7b74f16a748eb5c4fff46f0226ac8f1ae9dd9fa44
SSDEEP

12288:H0zx8ksX8YPaNqYifGzksNG4CX8jsQEC6IKAR7KrO8XrrOs+z6AP:U9aX8YnYifwksw4CXWsQEC5K7ZJAP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4780 wrote to memory of 1136	4780	rundll32.exe	rundll32.exe
PID 4780 wrote to memory of 1136	4780	rundll32.exe	rundll32.exe
PID 4780 wrote to memory of 1136	4780	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RCPicPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4780

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RCPicPlugin.dll,#1
2⤵
PID:1136