77763018072adb9e864f06deac9ae588a7ec4ea1a112f9f82c6201d5b7973e84

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 08:30

Target

plugins/test_plugin.dll
Size

69KB
MD5

870b80853839b674d6dc9c7f886ec1ec
SHA1

bb67999403c63d7c40ef9d2e493a27ced17881d5
SHA256

019adaf3ae57deb3bef5cb2353c2727d76020c97ea8bb8e3a7d01676d8066fae
SHA512

60569ee7cda4a8ff859bb984a7870a0ee6058f261cd7dea0c7b7d9f7e5dc4d86219e04f038e235b0dbe6370cb9ca2e24687359068826fe74ae5a09bc77afffbd
SSDEEP

768:n3zfOnXzX7pfL3N3wZuLzPW3G3QZ8QXg5mgFF7xPYgZhxcPoFMWbU+liCIWLqDFN:n3zWnztjSkeJXg4iPm9J+sCIWLeFnN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29
PID 956 wrote to memory of 1056	956	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\test_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\test_plugin.dll,#1
  2⤵
  PID:1056