5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75

Analysis

max time kernel
80s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 10:49

Target

Plugins/ActionTimer.dll
Size

111KB
MD5

e88ac8138e253c9ef0c068438d3e5586
SHA1

d68f2b9f3041af6c8e36175e822c79bf3e4e995c
SHA256

6630a385acb7f88c70f964fc08b411003801ee1575d23de7838ffaff9531b92f
SHA512

0f144f8a3b739b1d89fa5ddac5c97ee51e15e735cde4acea91a84a443f667b361c12a3d8591932da16fd6fe279450c8cd5a38f7582ca0cd30c07d110f2fdfe65
SSDEEP

1536:jkRlfSe/sWmcd+xvu98p+3m2cIlbyjzRDAfuEGVv3wE+tZPNqKSPgqU:ylfhZ+xm9R22cIlwzRDe/GV+SPgqU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 1168	4472	rundll32.exe	84
PID 4472 wrote to memory of 1168	4472	rundll32.exe	84
PID 4472 wrote to memory of 1168	4472	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\ActionTimer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\ActionTimer.dll,#1
  2⤵
  PID:1168