ce88c17c84daeb86c612bfda6c83a991e295c9f6c7ab81f08c5e34a5afa30584

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 00:11

Target

$PLUGINSDIR/installhelper.dll
Size

96KB
MD5

c73cc2747bcbcebc92e8288266888a86
SHA1

233ebfad299bd5b4646e24a633b61e9c588a3cab
SHA256

cc225801cb80b17cdab375a5ef6a55ba0fb3c133063654ee5281bc2f6c097b90
SHA512

e9c629563e8bd890fe466c29219c72ea6ec4982a924adeb781c3b13912d29cb18cc4d3d030394ea57d87efdfd68e5e15b4f86aeb297c20e4fadc031dbcb9352e
SSDEEP

1536:kF0nMUtgaxMXRtfeofO2YH+YzJbIJpLTZjXOEKY7dg0YKRlc02rFRWokDUUMw8:mUtMXRt2of1YH+YYSYxgH4KqlUxw8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28
PID 1580 wrote to memory of 2196	1580	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\installhelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\installhelper.dll,#1
  2⤵
  PID:2196