0d4e910847a8da89c1a61e75ddd8db232083e735486178457c547e6a3958dcc1

Analysis

max time kernel
144s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 10:21

Target

$PLUGINSDIR/Src/Protocol.dll
Size

668KB
MD5

a438e303cf31126c5d6b882aeded21a8
SHA1

eebe92a2e07ec209e6c366899938d2f7677e9977
SHA256

7c301b9c44cae3a53a4f939a391ae36e79e29f9216fc903665b4551426cecd90
SHA512

ddc47c35d7b662e939d471e07f5f45e979abd4df14b334c5c12f229f7d185bb9925693d9dd71e36c97eef02c92f961775f5d7cd605b36af9e6a5c9d83af3964b
SSDEEP

12288:dmaGqDdZHrLgjYSrXJ2YSIAkL2dFHZluIqNqSayOUpJyOwC+ATO3se:Y9qDdV3YWKNoSrHpJTNhTcse

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4896 wrote to memory of 3900	4896	rundll32.exe	rundll32.exe
PID 4896 wrote to memory of 3900	4896	rundll32.exe	rundll32.exe
PID 4896 wrote to memory of 3900	4896	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Src\Protocol.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4896

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Src\Protocol.dll,#1
2⤵
PID:3900