7bdbc9c96d08ae37f7ec2845584727ee301a7a26d1bc03b015b52d5804caffbb

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:41

Target

Plugin/PopMgrStub.dll
Size

1.3MB
MD5

518da492cfbd3e8faa7eb3b8b7a68ad0
SHA1

274d3c5db56923a770f23518775e9748abb2c21f
SHA256

73fa5520e612cd8f15eac65ed5df3eb8ec3dd21d411d6f9ffc003d6b37d5af3b
SHA512

ceca19d31f3cdf1c6a70238a4309f7569b5908c5c6f981434ff284cd48ef82528cf56b06700854e25fd3df9059ba2ecb6491bf0b8555582c7cbafeedeb1a7f04
SSDEEP

24576:ED/1gTa2SAc25iiWwdZnHLGh/l+YBsXRk+liYFhMmEm9HZ:Eh2Xc2MZwdZnHLGhl+YeXRJiYF6mEm95

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1384 wrote to memory of 2144	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2144	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2144	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2144	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2144	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2144	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2144	1384	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\PopMgrStub.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1384

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\PopMgrStub.dll,#1
2⤵
PID:2144