dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 04:35

Target
$PLUGINSDIR/file/AntiExp.dll
Size 574KB
Sample240617-e7s6waydqq
SHA256 d252e7202475a601d11bc99b1f71cddad6d43173bf451894ae3337467e9d6b86
MD5 8b7640b90a3a16c221134dd28a015a2a
SHA1 94550bbc3f70cac117e8d372ccbd3c3153caa537
SHA512 60c7673aff4ecccec313ff0323675c5ac7bbf4c58fc85b7a0f94f113fd8350446fdbdea9fc326d1b97cd32f1ff47545a237efc5d8cabf06ca434624c8400d473
SSDEEP 12288:Oa4+APSIk1CsbP0tl/DTL6hymvMTzjgf43R04bT:ORl/2hyLTzjck24bT
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 1748	216	rundll32.exe	85
PID 216 wrote to memory of 1748	216	rundll32.exe	85
PID 216 wrote to memory of 1748	216	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\file\AntiExp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\file\AntiExp.dll,#1
  2⤵
  PID:1748