43dd818938f2a189ae43dcaffa558ad39d518aa60ac096f0cdc0f1c35677a249

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 18:35

Target

plugins/advaimg.dll
Size

372KB
MD5

df22a0cc0b3198f78ead3ec83c951488
SHA1

908fed0e7a0d9f84856deefd33651f4500cd62c1
SHA256

7a2f6f51cf335c698f8d1e92d0b7a30fb2c167b7f6c4ed15bcd99e1417a1703a
SHA512

208a692c6bf60ce1d6eef6fa9dff0dffec68e9e45f98890658da1a625732227948ba0c551a8ee06b9329c6396c82125002085b81945fb22c4f35d1e817a32459
SSDEEP

6144:z9vi5jVFfzFjWndAHFRz4tgoP4big1xQNBVxMUvamoBLiTowu2JK1On+CgcKVo0e:z9OjfLFjWuFV4tBP4bHrUvaNLlpsKmgc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4588	5028	rundll32.exe	83
PID 5028 wrote to memory of 4588	5028	rundll32.exe	83
PID 5028 wrote to memory of 4588	5028	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\advaimg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\advaimg.dll,#1
  2⤵
  PID:4588