13d02ec2a076ccfab11ec0f8aa828df4cb95ad33757d7405a043c60abef986c6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 17:42

Target

$PLUGINSDIR/hhqqe.dll
Size

152KB
MD5

3a3506f522d0ee16b2c8a3d8e26cbed4
SHA1

c4d8b93116b966e0b4e313967e057d01dfaacee5
SHA256

711a82bdae65e2015eaa71dba09015a839660a665381e577701a2a0f6d47b3ae
SHA512

d86e99791427fe0fc174ff31139e5aba98e6ded8a1a4c9ac5460aac32b0c9a31c3046ac0820d3cfa9f17730c1b8cc335e448f46c7298ad42bb683f9c23d8e359
SSDEEP

1536:GNpt02q0vk31tn7XS/j2QOV/su0syBc0vifPKTPXOz4r6XJTm0mdA/xBc++X+RMl:GNEtwB8bHKjOsr6Zm0NcL+rG/ksMSg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2016	2408	rundll32.exe	28
PID 2408 wrote to memory of 2016	2408	rundll32.exe	28
PID 2408 wrote to memory of 2016	2408	rundll32.exe	28
PID 2408 wrote to memory of 2016	2408	rundll32.exe	28
PID 2408 wrote to memory of 2016	2408	rundll32.exe	28
PID 2408 wrote to memory of 2016	2408	rundll32.exe	28
PID 2408 wrote to memory of 2016	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hhqqe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hhqqe.dll,#1
  2⤵
  PID:2016