e9807419236323c64db44c33927744fe6e036232c643811c13d0411177390266

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 07:17

Target

$PLUGINSDIR/CleanVMsg.dll
Size

40KB
MD5

3170cf201ca067197084ea33035038ef
SHA1

8f3cb810f1d1e255d6d6e824e5cfd41552f6e5da
SHA256

01fa586eec4708e3028dfb276c94f63c44eddc556b022a0bce8e132ea1948597
SHA512

e1bff237e03751f4176c94c6d2684479d577cc7cec3691375d5ec34c8d015e26fef0e305f5a2b10c463e982323d936988168dc5071f3cd8090a0f7fbee72f3e3
SSDEEP

384:+P4rbSlT57iuBjR6cC7Xx4r7ruc8/l3jyuhSvr1OWuf+cA/8okdZO:LyTBiufqx4r2RjrSz1OWj/8oH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2300	2196	rundll32.exe	30
PID 2196 wrote to memory of 2300	2196	rundll32.exe	30
PID 2196 wrote to memory of 2300	2196	rundll32.exe	30
PID 2196 wrote to memory of 2300	2196	rundll32.exe	30
PID 2196 wrote to memory of 2300	2196	rundll32.exe	30
PID 2196 wrote to memory of 2300	2196	rundll32.exe	30
PID 2196 wrote to memory of 2300	2196	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CleanVMsg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CleanVMsg.dll,#1
  2⤵
  PID:2300