3aeea541c4fcdbf46b3e904522682e638b9ca7a981379864a72cf2274654419e

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 12:05

Target

windows_single_instance_plugin.dll
Size

82KB
MD5

00c451a17ddfcd810086fb2ad794125a
SHA1

feba77a0ca91f828099a3444a93ff11b6ce40fe5
SHA256

f1430479210c19093d76435e5826e3578420933248b51164e11f0992f77ed1f1
SHA512

6ea4d2556e0b82d017cde2a3c5c9b2881daca6b5af0e92cd10be886047eb6303085244ac1bb764e96595b3ca448504591c976dfefbffca8c6cbabe28f81e78c3
SSDEEP

1536:ET2xnGrpBkhdFk3ffx9z7yEzONPf1GMn8cmu516pgTcHbm2iIr:EqFGPaFkvZF/zIf1GMn89u516pgY7mnI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2992	2932	rundll32.exe	28
PID 2932 wrote to memory of 2992	2932	rundll32.exe	28
PID 2932 wrote to memory of 2992	2932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\windows_single_instance_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2932 -s 204
  2⤵
  PID:2992