7bdbc9c96d08ae37f7ec2845584727ee301a7a26d1bc03b015b52d5804caffbb

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:41

Target

Plugin/RunExtention.dll
Size

410KB
MD5

24ca7ac4d0412adc64c88c66b8b5f013
SHA1

c113a62b140a4edcb52a003ac6b5a4ad14d6371e
SHA256

22cbef303dfafa9b192e31b803178083010dfa7de716d8da9dd32d046dc8e946
SHA512

969ab24e742810f3ffa56fd4e3fab6087557b585bd38b292c632274fd004e2c6f11eb1b10510bedea8c7d102de326fa5dfb01eaaefd8f9ee7e838b8bc23df3fb
SSDEEP

6144:Ynagjoki30GF8kbBfvsJQ8JPHpl6LbzjrroENm2eK7mnoUSgpAY8ODcDcm7cIsQ8:10KlBEJPpwf/ozDSemg+wy3f7wI27

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2204 wrote to memory of 2952	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2952	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2952	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2952	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2952	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2952	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2952	2204	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\RunExtention.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\RunExtention.dll,#1
2⤵
PID:2952