128c7acb8d2cb842afcbe6bd73e951be139f1d9c760bfa81c08625ee4fcf5518

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 16:55

Target
$PLUGINSDIR/__ea8640c5926445e9a009f56b3951c44b_lib.dll
Size 708KB
Sample240603-vfbqhsch51
SHA256 dcf08a1cc39947e88969b717254f1dcb8b9f9787b3f43e0bfeb06cab39f3dc71
MD5 a739eb5eaa5cf8c8234450bc7d67fc37
SHA1 f45ba077c726d37ac7a8ee878bd0902d24dfe1ba
SHA512 5e3c3a45c40bd1d6f8e2700b640339ef428a3ae22ee3366ef6760acd01c1738f7987da9db1587445df12508122ef04c4f26d23bb5eb1aad83bbaed3fdee607c5
SSDEEP 12288:IiqgOcsDRSOSwADny14g7UFPb6CmW2KBrBMOd/13bYSBAVOvgiJns5QSkWKwwBLj:IiycstSpDLaYFP+iPBA0oiJniQSUxmDW
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2936	2932	rundll32.exe	28
PID 2932 wrote to memory of 2936	2932	rundll32.exe	28
PID 2932 wrote to memory of 2936	2932	rundll32.exe	28
PID 2932 wrote to memory of 2936	2932	rundll32.exe	28
PID 2932 wrote to memory of 2936	2932	rundll32.exe	28
PID 2932 wrote to memory of 2936	2932	rundll32.exe	28
PID 2932 wrote to memory of 2936	2932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\__ea8640c5926445e9a009f56b3951c44b_lib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\__ea8640c5926445e9a009f56b3951c44b_lib.dll,#1
  2⤵
  PID:2936