5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75

Analysis

max time kernel
51s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 10:49

Target

Plugins/AdvancedCPU.dll
Size

92KB
MD5

9479b71abccc8b4baf28f18ae1b62829
SHA1

ab375c0992ff752e2b2338793eb11165dd07da24
SHA256

588ffaf985166e119c9ac8dc37d190c9f6f4e71ccad83f17e2972b60ff233454
SHA512

3f886239965334204c510e779db05f8ac07af9185a2c62f71e8c25f5f2ff46d8891f42c05ddbe35ea7a12858e06d3868713a19187ed19cff163678ae3b8184c0
SSDEEP

1536:6kSlfsWoAYcdvaf2aNOiNb4OQZZVieo21AfhfDq6zWjuNL7AHtW8OZUMWE8Gk:6kVWvaeaNTb4OQ3omAfNGuNnAaUMWE8f

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 3740	4076	rundll32.exe	82
PID 4076 wrote to memory of 3740	4076	rundll32.exe	82
PID 4076 wrote to memory of 3740	4076	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\AdvancedCPU.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\AdvancedCPU.dll,#1
  2⤵
  PID:3740