77763018072adb9e864f06deac9ae588a7ec4ea1a112f9f82c6201d5b7973e84

Analysis

max time kernel
136s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 08:30

Target

plugins/clientquery_plugin.dll
Size

683KB
MD5

71d73d852e7748a51eafe7f0d7222a23
SHA1

82ff0a13cff08027e9791362e67e0153b753f484
SHA256

a5e9de4f3091d223eb42e25b7df18052b4353f44864092e94e20046391e00d09
SHA512

f12db1b39ffb6e851ad90910a13be9167c909ade890d63563b350b1895f9f38e0e3ee84781351326fe2c77b5d3359ff1d8790455fdf40801beb8297c0aabc161
SSDEEP

12288:Y+G/cG/ZD3PNLXGPVBtDf3q/iJtc/XSSzSrqYIBDc9wwslXXX7sbc:xG/8L0iuCSYIBDcRqXXX7sg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 768	1716	rundll32.exe	84
PID 1716 wrote to memory of 768	1716	rundll32.exe	84
PID 1716 wrote to memory of 768	1716	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\clientquery_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\clientquery_plugin.dll,#1
  2⤵
  PID:768