a800e519e6989f9500ef24e47cdafe7e9c3aad6f0e808799ca5e86d6c0945a43

Analysis

max time kernel
95s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 08:51

Target

$PLUGINSDIR/LaunchHelp.dll
Size

66KB
MD5

70dd6708ae72686b372579d82e77ea91
SHA1

bfd7885d5de6c2f0eeefacd51d902a527ddea06c
SHA256

73637709cf3011256c85a1663f6ceeac86985575e94a49c0f3667b1603e78fb8
SHA512

317b842faafc7a45a234074d0c5cd93ce81a6fbb3dacc04842d7d94ced468fd24bd197020203382a2114efc77571e05e34ac635f34b69dc1a0ecf8f269b45d2a
SSDEEP

768:0AVPzAnhYtIvY/09Xa/k1ZfEkO9QNxhJOfLYwLgEnBC/tkeeX+AiOUEDInqUC3K7:0GzrtIiMjHQfLYwLJnI/tkzWJCS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 4688	2588	rundll32.exe	83
PID 2588 wrote to memory of 4688	2588	rundll32.exe	83
PID 2588 wrote to memory of 4688	2588	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LaunchHelp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LaunchHelp.dll,#1
  2⤵
  PID:4688