4824b32e77aaa215c6497d16df9c022feddd5162fc8a3aa67a609150d91b8e92

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:15

Target
$PLUGINSDIR/RCWidgetPlugin.dll
Size 5.2MB
Sample240604-ajw6eaed2w
SHA256 2d158ba1e557aff957947ceb927183d1148acd8f54a0029083be619e2844cf36
MD5 713c4b658cbbef6e7ca8c298689b2281
SHA1 f4d4d5d9ed19786abebd4f028dbcabd563895e35
SHA512 b69f0e1748dd5f3c4497dca21899826648d09f2979ec608e69a04b9a3fc1fac1972149f2fa50503c80f3ff8e13456b50cf70e31b17fe5cc2fafe1a5fd1b26955
SSDEEP 49152:r4dxo8I4F/hfRumdzTxx81C+H0P3UekweGRgpS1CzHrPiWDhpPQEpWuyXoiLdaur:cdxoijJphDkwopS1gTDjlU4iL0iKjbGH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 4016	1324	rundll32.exe	84
PID 1324 wrote to memory of 4016	1324	rundll32.exe	84
PID 1324 wrote to memory of 4016	1324	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RCWidgetPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RCWidgetPlugin.dll,#1
  2⤵
  PID:4016