fc096c55e733a3ff75b2b2edb9f4836a02866fb1e52bb8d8d7e284654660192a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 17:31

Target

$PLUGINSDIR/FloatingProgress.dll
Size

25KB
MD5

a5d0a090bd2c768b97ca11380bf4ae56
SHA1

48355d0470c8351e8ac0c031a025c8cf467de0ef
SHA256

16fff8d5d3ba32a5c063a12cca6dbabbe80068d023383e112079c960ec437b35
SHA512

d63137eeba8d56a201d1c2f7a5b2caa93dac5da8c9310eebdf2ce389f50668baae3a84d42963857443e0a25ff73abff31291a88f6ef305e86b743c0d27b54292
SSDEEP

192:4524fcob73yFDoUjSFWbY3Lf+25meJVOuN+Sx10mvmWc4b6bW:45v7Ifc7fV8C+I2mw4b6bW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2308	2292	rundll32.exe	28
PID 2292 wrote to memory of 2308	2292	rundll32.exe	28
PID 2292 wrote to memory of 2308	2292	rundll32.exe	28
PID 2292 wrote to memory of 2308	2292	rundll32.exe	28
PID 2292 wrote to memory of 2308	2292	rundll32.exe	28
PID 2292 wrote to memory of 2308	2292	rundll32.exe	28
PID 2292 wrote to memory of 2308	2292	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FloatingProgress.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FloatingProgress.dll,#1
  2⤵
  PID:2308