878a3591058508c40d3575cda56aadc887c84143bcb0e51b46c74280f0ea328f

Analysis

max time kernel
135s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:23

Target

$PLUGINSDIR/RCPicPlugin.dll
Size

976KB
MD5

983a34463e33a15a9c07fabfd1e1d20b
SHA1

27ccc9224021ba5dde0745a9e37cdf938bb04090
SHA256

d486b6ec021008a0fe0bc90938590544add1dc35bb839eda3e01084069a96e07
SHA512

9dfcad69b468ab38eac0994e195034e4095d1a91cdeff96f1e14d0f9daff052659b88af65212ea85f209d1b7b74f16a748eb5c4fff46f0226ac8f1ae9dd9fa44
SSDEEP

12288:H0zx8ksX8YPaNqYifGzksNG4CX8jsQEC6IKAR7KrO8XrrOs+z6AP:U9aX8YnYifwksw4CXWsQEC5K7ZJAP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3164 wrote to memory of 5016	3164	rundll32.exe	rundll32.exe
PID 3164 wrote to memory of 5016	3164	rundll32.exe	rundll32.exe
PID 3164 wrote to memory of 5016	3164	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RCPicPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RCPicPlugin.dll,#1
  2⤵
  PID:5016