9d6ed95597857927f0e7e6eb1495c4ec10fa74aced7efbc9199c4392be7585a6

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:57

Target

$PLUGINSDIR/workerExtension.dll
Size

405KB
MD5

a14794d427c2375166471c93a240dd73
SHA1

dfe072501fd08496784af62b314cdb10cbe79550
SHA256

f5b18bb25f67f08fbaf40328791236bca30ab18c642c9a66efc12d074724746b
SHA512

65e3fabcbda798279bd24a99809363efc407c82209348feb18341f26990680de4de5eff6e746e642e69e9b78fb5308a8b38fca7c52cf584c709520486fc13906
SSDEEP

6144:rG1SwZ6az959GnJdDEByqjNoJGwtYvhSf5mH4BhPgXhgKS4:rG1Y5cBy+SJrfAH4BhK1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 224 wrote to memory of 1904	224	rundll32.exe	rundll32.exe
PID 224 wrote to memory of 1904	224	rundll32.exe	rundll32.exe
PID 224 wrote to memory of 1904	224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\workerExtension.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\workerExtension.dll,#1
2⤵
PID:1904