06a448f5d8d34f922d25a4bf5bf1fd0eea0624b799c68677becd75135abb0d52

Resubmissions

13-07-2024 04:14

max time kernel
1561s
max time network
1567s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 04:14

Target

[ProductDir]/HttpUpdaterPlugin.dll
Size

44KB
MD5

3ff305822b4aa1198f41855acdbacd4b
SHA1

8445b0a48868ef9db88fc48a8cb889be8170e712
SHA256

1714a109c6b2edac2ba5c1e789471e27fea7defc8eecf947409e929d90ef9796
SHA512

5a18322c53f9686b5548bea2c02c4c53226938d101619e18b02ca66d9df293b645b6e0fcdaea68435a975b42dfaab5c628fd6a59a67cb959bd85b22973cdb619
SSDEEP

768:xkJu/LX0hoHGxNYAGF7gQoPpz7XuYitbpoiENAMxbBSp17isS9:xkALkhoHGxN4FzoPpz7+7tbyxb655m

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2160	2992	rundll32.exe	31
PID 2992 wrote to memory of 2160	2992	rundll32.exe	31
PID 2992 wrote to memory of 2160	2992	rundll32.exe	31
PID 2992 wrote to memory of 2160	2992	rundll32.exe	31
PID 2992 wrote to memory of 2160	2992	rundll32.exe	31
PID 2992 wrote to memory of 2160	2992	rundll32.exe	31
PID 2992 wrote to memory of 2160	2992	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\[ProductDir]\HttpUpdaterPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\[ProductDir]\HttpUpdaterPlugin.dll,#1
  2⤵
  PID:2160