a800e519e6989f9500ef24e47cdafe7e9c3aad6f0e808799ca5e86d6c0945a43

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 08:51

Target

$PLUGINSDIR/Install.dll
Size

258KB
MD5

7b915d6227d9f4dfe30b9f979f5976e7
SHA1

6157749d1e4432227d226457b247472f0b9697a8
SHA256

4b74e01dc6fbdf0fad39e6e68a498dfa7708098a87d945ae0da1b8a20fb272cb
SHA512

8f6b3e14a0f505eaf3be21dd1d0ca022e9006bf599d03f0d7cd54c61514b79236f2b3b7333107902b3d72c9ad2a7255b184137c9836b2d0d5ce3ef4459461a88
SSDEEP

3072:QrszqM+KaRtkXTQKiW5pSMTIY2RayNTOZ8tFNF5Rao1iv3/PmBGUr8ak4WYOMnV1:RzqzXEftTgRayNyZO5rA3/+ludMnL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 4084	3936	rundll32.exe	83
PID 3936 wrote to memory of 4084	3936	rundll32.exe	83
PID 3936 wrote to memory of 4084	3936	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Install.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Install.dll,#1
  2⤵
  PID:4084