0ce5e5be2bd5eea2fe56e9332eb9f7aee3d7c78df61fe41ba3fde8e268076f12

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 14:26

Target

Plugins/Monitoring/GPU.dll
Size

23KB
MD5

cdc839f37066b83d0d44b44ea9a89f12
SHA1

864b7d15188c675cb1706c37eef712a779d6f732
SHA256

206dedab89d7430a8a9693662431ca7a177ebc701005d026f3040ea620d12e59
SHA512

abcaf2b8a3494a04c8bc3ccd2ead9aa5cb73ae4c77b3d6cb56180952840b919d6a4710eb2c5fed50d3204f85d01a74787cdcf6661210545981898f3afa344484
SSDEEP

384:Wf+HFWBl/c5ux4CfQlWV3pnB8b/ZsD9jLIzQoMU5RW9aOy5gs7pHvgRGt:WS8Bl/MefFV3pnBVD9HI8o9AaOyh7pHi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2912	1744	rundll32.exe	28
PID 1744 wrote to memory of 2912	1744	rundll32.exe	28
PID 1744 wrote to memory of 2912	1744	rundll32.exe	28
PID 1744 wrote to memory of 2912	1744	rundll32.exe	28
PID 1744 wrote to memory of 2912	1744	rundll32.exe	28
PID 1744 wrote to memory of 2912	1744	rundll32.exe	28
PID 1744 wrote to memory of 2912	1744	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\Monitoring\GPU.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\Monitoring\GPU.dll,#1
  2⤵
  PID:2912