3a535814023d01b99aec8e98e291a9e96dec22036f6ddf32155f47e5e4af93b4

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 04:48

Target

$PLUGINSDIR/evnlygoa.dll
Size

16KB
MD5

8ed79ba21eea27180585788ff0b88c1a
SHA1

d5b9a67e668262fa857c13531dcc2be76d87bbae
SHA256

0f9d6c7dd90cbcfef51b5917e214f5e75b8fc10f25ff46deb6f6d304f1e4afe6
SHA512

b2289f8c59885cd23941a8dfd00bfb018af5c9b926726362157c5a5b257b42b59a6e48ccb9ab7cfa45b190ac244617a7bfdc34ff8eb04f8ba840613f0d925dbc
SSDEEP

192:pkDqveVwq3/xTQqf8giRokjJMYHYLDFWGqgroe/DD8IiCeJ2/20mCKG1IyZ:q24wq35TR8pocYL0zED8kae221Iy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 3040	5032	rundll32.exe	83
PID 5032 wrote to memory of 3040	5032	rundll32.exe	83
PID 5032 wrote to memory of 3040	5032	rundll32.exe	83
PID 3040 wrote to memory of 2052	3040	rundll32.exe	87
PID 3040 wrote to memory of 2052	3040	rundll32.exe	87
PID 3040 wrote to memory of 2052	3040	rundll32.exe	87
PID 3040 wrote to memory of 2052	3040	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\evnlygoa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\evnlygoa.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\evnlygoa.dll,#1
    3⤵
    PID:2052

memory/3040-0-0x0000000075870000-0x0000000075879000-memory.dmp

Filesize
36KB

Download