dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 04:35

Target
$PLUGINSDIR/KVInstallHelper.dll
Size 807KB
Sample240617-e7s6waydqq
SHA256 5a7a171b6fbf66e399e2bb19449fc7bd00e94a2df800a64221068f77508ff0cc
MD5 129c341be402821aa5ce06b596d241c1
SHA1 8c9f65c687db02872626ce7a9cf530aac5765168
SHA512 fc91d299b4f88f4e25a1fceeefeabc0bac6ba324c21c88ae05e53277011bded81ff88a8c2b4f196a181201753585532f303eb5b3e4cbd0909af646be8b0ed75c
SSDEEP 24576:3nlqORLs3mUtrOEVv3QxfdgU0T39XABg9Q:XlqORL9EVv3Q87T3deyQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1848	2260	rundll32.exe	28
PID 2260 wrote to memory of 1848	2260	rundll32.exe	28
PID 2260 wrote to memory of 1848	2260	rundll32.exe	28
PID 2260 wrote to memory of 1848	2260	rundll32.exe	28
PID 2260 wrote to memory of 1848	2260	rundll32.exe	28
PID 2260 wrote to memory of 1848	2260	rundll32.exe	28
PID 2260 wrote to memory of 1848	2260	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KVInstallHelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KVInstallHelper.dll,#1
  2⤵
  PID:1848