e51bac091a171091098a61a2706c410ff7896d04f1f82bcec6c8b42447544805

Analysis

max time kernel
134s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:50

Target

Plugins/bilinearlight.dll
Size

4KB
MD5

722ebb5a52b3e4a815400a5f31309352
SHA1

601dbb0f73f0309cf3a8cf9782c72c45621874e7
SHA256

d5f02b45ddff88a8ea18b8119eda4e6bd78d56e42eb215f87f6205bd658bc576
SHA512

1cdcf2d327f90800dbff4e9d3bb20db09d9cb1a1b9cad2c70d9fb20c21fb2b125a23cb3fe9af52fefcf013813a6a4805fcfa7fc9811ded9ce9407928ce6816db
SSDEEP

24:etGSPOHucIo1DGgGDc7XyPOfaRKqtzHlw3pv2qFslqMujgy5pSd+lBzzJFtGItts:6POOC6xDYiPOCpwN2DqM5JUp92It/e

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4504 wrote to memory of 1488	4504	rundll32.exe	rundll32.exe
PID 4504 wrote to memory of 1488	4504	rundll32.exe	rundll32.exe
PID 4504 wrote to memory of 1488	4504	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\bilinearlight.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4504

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\bilinearlight.dll,#1
2⤵
PID:1488