1e4519b90828e71ac7b3f6e6eeb3463a02462640433e6b384206cf852931c4a4

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 05:12

Target

$PLUGINSDIR/LaunchHelp.dll
Size

66KB
MD5

848e419d749f41014858bd67c5b0b840
SHA1

6e8baeebb7919d38d64825fbf3aaafb9d7cce90a
SHA256

598b0affe5eda00c6f3eccd1425e2384f96ca885ee1a9a39dc37ae0702a078d1
SHA512

49a96bf14526517329d9bbcca8c4e64c4e3eaea392a88f7ab4604ff5565e027a4ae67551dac8519e8ac16a76089df94e353727709770dfdb740110de98c71beb
SSDEEP

768:VAVPzAnhYtIvY/09Xa/k1ZfEkO9QNxhJOfLYwLgEnBC/tkeeXzAiOUEDInQUC3KN:VGzrtIiMjHQfLYwLJnI/tkzRjm8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4760	4424	rundll32.exe	83
PID 4424 wrote to memory of 4760	4424	rundll32.exe	83
PID 4424 wrote to memory of 4760	4424	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LaunchHelp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LaunchHelp.dll,#1
  2⤵
  PID:4760