0d4e910847a8da89c1a61e75ddd8db232083e735486178457c547e6a3958dcc1

Analysis

max time kernel
123s
max time network
134s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 10:21

Target
$PLUGINSDIR/chkm.dll
Size 74KB
Sample240526-md41aaff62
SHA256 2061a94b4d34a77f935f95a3741f917c91b27d0e1585c2ee2f8e00806b671db7
MD5 3b8308f1dba641b49a642fa6d92f3451
SHA1 a11164e08bd9c594b6d608c51a2428a4c6b555a2
SHA512 dc089fc2bb43ccfcca8748013636e8d249cd91e1b08b30358d00df0decaec5782d2af85274e7b70784d4e58c934dfe5112fdcb4006de2a5dbe9c76dae9ed1f81
SSDEEP 768:9elCeN9djBHTUURm58yTOM30Hz6pW+QLqr69p4R1t8iKkEL:9elD9djBYqyTOS0T6UBLNWt8iC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2188	rundll32.exe
2188	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2188	1740	rundll32.exe	28
PID 1740 wrote to memory of 2188	1740	rundll32.exe	28
PID 1740 wrote to memory of 2188	1740	rundll32.exe	28
PID 1740 wrote to memory of 2188	1740	rundll32.exe	28
PID 1740 wrote to memory of 2188	1740	rundll32.exe	28
PID 1740 wrote to memory of 2188	1740	rundll32.exe	28
PID 1740 wrote to memory of 2188	1740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\chkm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\chkm.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2188