16e04f642c910df87e272e0d1ef2c908f7796963556fb6b4b31ed1a348ae6dd9

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 21:09

Target

$PLUGINSDIR/Helper.dll
Size

1.3MB
MD5

829afd8bb1e894455d3641861052e965
SHA1

b6f04025f9f9f4d757b80e3cf5f427da26a2b09b
SHA256

7b9fb44ab0fe4a7166aa24a92ad6c5c97a0349d015f86c4347392abf046a9737
SHA512

4fafc5a74af6015938c13dd829de80e6b6a3cb9aa066de071fd3f45acd5f4e89c7db8f34a0ec5bc0cd8c45aa0e3f21a59bb075ede1e82e6796040471eb829400
SSDEEP

24576:sWB/iQHyV8K0pQFB/D3JwHlC0kZJIaNPP7l80hcd0hUSUWB5ZXXoevQQY:sPQHyV8K8QFB/D3JwHlcJxH7vhmpbsXG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2692	2436	rundll32.exe	28
PID 2436 wrote to memory of 2692	2436	rundll32.exe	28
PID 2436 wrote to memory of 2692	2436	rundll32.exe	28
PID 2436 wrote to memory of 2692	2436	rundll32.exe	28
PID 2436 wrote to memory of 2692	2436	rundll32.exe	28
PID 2436 wrote to memory of 2692	2436	rundll32.exe	28
PID 2436 wrote to memory of 2692	2436	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Helper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Helper.dll,#1
  2⤵
  PID:2692