3ed099949a8004f1f707345cfae43d46527b5442dd49a6d229f143f91a468315

Analysis

max time kernel
22s
max time network
19s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 21:48

Target

Plugins/64bit/GPMDPPlugin.dll
Size

772KB
MD5

7a1e26e397c342ad6f5ec4b8fcf7d2b7
SHA1

3a94e5ffe7b112a9e6aa4e565564d75cb85acd85
SHA256

6a49f30706c514fc9326c6004fd60520c33bf24b587e9b20028033babbc8bcb6
SHA512

0afec3bd0e6ff80d9c111a9441bc3a7aeda4126289bc13a8b8a6d1ee8f7178bc278ae914e145d7f4202e6706d53bc6c5340cd711dfbf46f88605654a7ea8b2fc
SSDEEP

6144:OBssyPvsSEE8g/N/r2uEoPKCL8hnWUISKdefIHT4YjxZAnzQA1a6jhHewUppMTxd:lL/Jr2uL8ip/Syr7f8T/qJuVym/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1688	1736	rundll32.exe	29
PID 1736 wrote to memory of 1688	1736	rundll32.exe	29
PID 1736 wrote to memory of 1688	1736	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\64bit\GPMDPPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 396
  2⤵
  PID:1688

memory/1688-4-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1736-0-0x000000001B040000-0x000000001B10A000-memory.dmp

Filesize
808KB

Download
memory/1736-2-0x000007FEF58BE000-0x000007FEF58BF000-memory.dmp

Filesize
4KB

Download
memory/1736-1-0x0000000002000000-0x0000000002080000-memory.dmp

Filesize
512KB

Download
memory/1736-3-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

Filesize
9.6MB

Download
memory/1736-5-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

Filesize
9.6MB

Download
memory/1736-6-0x0000000002000000-0x0000000002080000-memory.dmp

Filesize
512KB

Download