229cbbac4a8000069d5ea52b0a864345b2e0a624f152f7f0472b942d2f269e29

Analysis

max time kernel
139s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2024 20:26

Target

PvZ_Tools_v2.7.5/bearer/qgenericbearer.dll
Size

35KB
MD5

28838971e52d14d8f510562d453d441c
SHA1

af5a903c7110bf46aa548dbb40c8684a7518bd16
SHA256

57b7356986e5b82872899a33d246334331f353ef26547de33f4f151ec47cbac1
SHA512

7592d4617ddf82ae6d3f16aa2480519d7c913db45e5ddde00970cb5a563019f4a28d0eab43cb1dc5b168bb787041f85a7196b424aabf6d62c8723d2b9aab69ff
SSDEEP

768:q6bsk5gUJ6OEBYFsH0kGoUeN3gaAH2y8i9aoXU1DD+y4j:qlkK1D+S01Wdga69aoXSDD+L

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 3256	2740	rundll32.exe	83
PID 2740 wrote to memory of 3256	2740	rundll32.exe	83
PID 2740 wrote to memory of 3256	2740	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\bearer\qgenericbearer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\bearer\qgenericbearer.dll,#1
  2⤵
  PID:3256