2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5

Analysis

max time kernel
1558s
max time network
1560s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 01:00

Target

x86/plugins/HardwareDevices.dll
Size

157KB
MD5

7c35a25859271e4550580a5b6ec769fa
SHA1

b99b6c10bc2b95cbd5270ca7549f54b5d69f8eb2
SHA256

e0c91ad1ead26ba93257059b5a7600c6fc3baf3278499d850e9e884fea409761
SHA512

c5d93b421a0a63c6c7fbf5684716c967d5176115627291ae680225b091c570ae53eec17ec306451a810432fc96b3c833294a62de67b2b5bb5df0e0c5fb525f4d
SSDEEP

3072:2ELgmODhaGSOL6YBpBZilmm9/tfm9V5OrIkPxXSm4TRs8pPp/Batj:2ELgmODhaGSOL6YBpBolmm9wUrRxI37Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2108	2228	rundll32.exe	28
PID 2228 wrote to memory of 2108	2228	rundll32.exe	28
PID 2228 wrote to memory of 2108	2228	rundll32.exe	28
PID 2228 wrote to memory of 2108	2228	rundll32.exe	28
PID 2228 wrote to memory of 2108	2228	rundll32.exe	28
PID 2228 wrote to memory of 2108	2228	rundll32.exe	28
PID 2228 wrote to memory of 2108	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\HardwareDevices.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\HardwareDevices.dll,#1
  2⤵
  PID:2108