e67777b181a1ca1f21890bd0da9b177bcd850498375af8f1b0d3d61c7a54c9d0

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 12:35

Target

$PLUGINSDIR/MngModule.dll
Size

879KB
MD5

03c1c25a70050b9f7fe35574fd55496c
SHA1

d54445619e837928514eb0d029d89a8aff06d78d
SHA256

5a6e0727f0de9a9c507e54c705d7894a110bd07db7a4aab04f33e2701f78671a
SHA512

1caa89facf88c83c9c49373662d64abad13685d19dff8375e179ca03895dfeb5d997494300fb75d546ce2c45ed7d16c817d27986a1c5c32c6a7dd6bc249c5ce3
SSDEEP

12288:GkG5zKMfxw5Opn+dCyx8yBaESrHKS22+ugcHKuUKbf9ca45/iNGPEOJV5IV:+PpnDyBi7fkuuKbma45/iNGPEOJV5IV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 500	2324	rundll32.exe	81
PID 2324 wrote to memory of 500	2324	rundll32.exe	81
PID 2324 wrote to memory of 500	2324	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MngModule.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MngModule.dll,#1
  2⤵
  PID:500

memory/500-0-0x0000000060900000-0x000000006096E000-memory.dmp

Filesize
440KB

Download