2397ac46ad9b52de1b72d6821ce44f6fd4815ea6abe449d1b731120d1e0c5ce2

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 14:10

Target

$PLUGINSDIR/lDerpvVTsgA.dll
Size

650KB
MD5

e4bdc739307f32b968e32fcebc9c01f6
SHA1

5f3d406f01579e3e8a67c05d2e31ec369e14604c
SHA256

17d489476f1f2fbe95a5ddb2a95a788528db842153c5582457133a79eb0756e0
SHA512

494ab1baf1ba59aa6cb4209dae8d493b784d289c74ba66b34d826aebb4014bb2fdfa3f30680650408048d9197cab5b945936c36cac9529c220048cef4704224e
SSDEEP

12288:CTCku/rrJa/ou0Jjppg9Zpnin6QCZeK+YhzyO7LO2TllcrSNCCaBO4m2JEMS7aKd:CWfFrK+Y/7LH+8P4mH7aKKK4O

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 3280	3552	rundll32.exe	82
PID 3552 wrote to memory of 3280	3552	rundll32.exe	82
PID 3552 wrote to memory of 3280	3552	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\lDerpvVTsgA.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\lDerpvVTsgA.dll,#1
  2⤵
  PID:3280