b622013c43ce8d926d5adad74ba9364c37d31b8343510e36dc5d43962b6e92dd

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2024 07:24

Target

$PLUGINSDIR/ProcDll.dll
Size

1.4MB
MD5

782946212ed94c1e891f31592c65fffc
SHA1

c05d47da2f576da8c9d4b2d08e6eb7eb59567c02
SHA256

6320db35a424767ed778e27339d8bbeaea839beeb3612142a281111e431d004f
SHA512

b7006fbb4de0a98c616db0c999a0dc8bbc2749bc00fa4aa8b4790fa0c7de405c9efae4adfd887c4001bf14673d4b9b8ae04962ec97bc6c0190c48e89a6746553
SSDEEP

24576:XtRHNjBYOMk19RS1FOfIqrFV+m4jibH0ZpoxRSa0U8yxSg3IJ/rD:fNjrSbOxFEm5zSDySg4J/rD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 1836	4960	rundll32.exe	84
PID 4960 wrote to memory of 1836	4960	rundll32.exe	84
PID 4960 wrote to memory of 1836	4960	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ProcDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ProcDll.dll,#1
  2⤵
  PID:1836