Overview
overview
4Static
static
32026-06-04...ys.exe
windows10-2004-x64
32026-06-04...ys.exe
windows11-21h2-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-21h2-x64
3$PLUGINSDI...in.dll
windows10-2004-x64
3$PLUGINSDI...in.dll
windows11-21h2-x64
32345ImageApp.dll
windows10-2004-x64
32345ImageApp.dll
windows11-21h2-x64
32345PdfReader.exe
windows10-2004-x64
42345PdfReader.exe
windows11-21h2-x64
42345Pic.exe
windows10-2004-x64
42345Pic.exe
windows11-21h2-x64
42345PicEditor.exe
windows10-2004-x64
42345PicEditor.exe
windows11-21h2-x64
42345PicLoader.exe
windows10-2004-x64
42345PicLoader.exe
windows11-21h2-x64
42345PicUpdate.exe
windows10-2004-x64
42345PicUpdate.exe
windows11-21h2-x64
42345PicViewer.exe
windows10-2004-x64
42345PicViewer.exe
windows11-21h2-x64
4Analysis
- max time kernel
86s - max time network
128s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 09:42
Static task
static1
Behavioral task
behavioral1
Sample
2026-06-04_3006a3a634cc89b718e7719d12c56caf_elex_maze_rhadamanthys.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-06-04_3006a3a634cc89b718e7719d12c56caf_elex_maze_rhadamanthys.exe
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FileInfo.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FileInfo.dll
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/RCWidgetPlugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/RCWidgetPlugin.dll
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
2345ImageApp.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
2345ImageApp.dll
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
2345PdfReader.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
2345PdfReader.exe
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
2345Pic.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
2345Pic.exe
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
2345PicEditor.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
2345PicEditor.exe
Resource
win11-20260513-en
Behavioral task
behavioral15
Sample
2345PicLoader.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
2345PicLoader.exe
Resource
win11-20260513-en
Behavioral task
behavioral17
Sample
2345PicUpdate.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
2345PicUpdate.exe
Resource
win11-20260513-en
Behavioral task
behavioral19
Sample
2345PicViewer.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
2345PicViewer.exe
Resource
win11-20260513-en
General
- Target 2345ImageApp.dll
- Size 1.2MB
- Sample260604-lpmppsb17w
- SHA256 7ee6e690153aa7a1ec0ffb704c71af1a797cdfaf43e23c05b907e44fb50c0166
- MD5 8cf4bcabce96bfed1a4eaaa7431d7acc
- SHA1 8a72874762a7382bdb3bb83d7f16b4d269c94f3e
- SHA512 4943bdfe63fb5ee869708a9ce8bf926728db9407e53d1363977ceed90b2c8e7f1783fe3d236a22f4acac30d1a44fa4e99b210e7f07621889185351b2a30eb3e2
- SSDEEP 24576:M6PTcYisWQoHynr3XbW4XA/GzphQuf9VenavI6gd3vCJ:MUWsWnynr3rF9
- TLSH T1D2451A02E75B72E9DE9A00B022FF7B1EA0290B48536B1FD3E7286E5155314E17D3BA4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4752 wrote to memory of 3568 4752 rundll32.exe 84 PID 3568 wrote to memory of 2840 3568 rundll32.exe 85 PID 2840 wrote to memory of 4920 2840 rundll32.exe 86 PID 4920 wrote to memory of 1628 4920 rundll32.exe 87 PID 1628 wrote to memory of 3348 1628 rundll32.exe 88 PID 3348 wrote to memory of 2044 3348 rundll32.exe 89 PID 2044 wrote to memory of 4532 2044 rundll32.exe 90 PID 4532 wrote to memory of 3860 4532 rundll32.exe 91 PID 3860 wrote to memory of 3224 3860 rundll32.exe 92 PID 3224 wrote to memory of 1552 3224 rundll32.exe 93 PID 1552 wrote to memory of 2936 1552 rundll32.exe 94 PID 2936 wrote to memory of 4496 2936 rundll32.exe 95 PID 4496 wrote to memory of 1444 4496 rundll32.exe 96 PID 1444 wrote to memory of 1660 1444 rundll32.exe 97 PID 1660 wrote to memory of 4484 1660 rundll32.exe 98 PID 4484 wrote to memory of 2244 4484 rundll32.exe 99 PID 2244 wrote to memory of 4744 2244 rundll32.exe 100 PID 4744 wrote to memory of 1680 4744 rundll32.exe 101 PID 1680 wrote to memory of 1724 1680 rundll32.exe 102 PID 1724 wrote to memory of 1448 1724 rundll32.exe 103 PID 1448 wrote to memory of 1376 1448 rundll32.exe 104 PID 1376 wrote to memory of 3452 1376 rundll32.exe 105 PID 3452 wrote to memory of 1788 3452 rundll32.exe 106 PID 1788 wrote to memory of 4988 1788 rundll32.exe 107 PID 4988 wrote to memory of 1576 4988 rundll32.exe 108 PID 1576 wrote to memory of 2944 1576 rundll32.exe 109 PID 2944 wrote to memory of 2484 2944 rundll32.exe 110 PID 2484 wrote to memory of 3636 2484 rundll32.exe 111 PID 3636 wrote to memory of 2040 3636 rundll32.exe 112 PID 2040 wrote to memory of 1932 2040 rundll32.exe 113 PID 1932 wrote to memory of 3000 1932 rundll32.exe 114 PID 3000 wrote to memory of 3188 3000 rundll32.exe 115 PID 3188 wrote to memory of 1452 3188 rundll32.exe 116 PID 1452 wrote to memory of 4636 1452 rundll32.exe 117 PID 4636 wrote to memory of 3236 4636 rundll32.exe 118 PID 3236 wrote to memory of 4152 3236 rundll32.exe 119 PID 4152 wrote to memory of 3540 4152 rundll32.exe 120 PID 3540 wrote to memory of 3176 3540 rundll32.exe 121 PID 3176 wrote to memory of 112 3176 rundll32.exe 122 PID 112 wrote to memory of 4940 112 rundll32.exe 123 PID 4940 wrote to memory of 4928 4940 rundll32.exe 124 PID 4928 wrote to memory of 4936 4928 rundll32.exe 125 PID 4936 wrote to memory of 692 4936 rundll32.exe 126 PID 692 wrote to memory of 4144 692 rundll32.exe 127 PID 4144 wrote to memory of 4656 4144 rundll32.exe 128 PID 4656 wrote to memory of 3120 4656 rundll32.exe 129 PID 3120 wrote to memory of 2864 3120 rundll32.exe 130 PID 2864 wrote to memory of 1756 2864 rundll32.exe 131 PID 1756 wrote to memory of 4468 1756 rundll32.exe 132 PID 4468 wrote to memory of 2168 4468 rundll32.exe 133 PID 2168 wrote to memory of 4800 2168 rundll32.exe 134 PID 4800 wrote to memory of 2280 4800 rundll32.exe 135 PID 2280 wrote to memory of 2268 2280 rundll32.exe 136 PID 2268 wrote to memory of 656 2268 rundll32.exe 137 PID 656 wrote to memory of 4640 656 rundll32.exe 138 PID 4640 wrote to memory of 2236 4640 rundll32.exe 139 PID 2236 wrote to memory of 1888 2236 rundll32.exe 140 PID 1888 wrote to memory of 1996 1888 rundll32.exe 141 PID 1996 wrote to memory of 472 1996 rundll32.exe 142 PID 472 wrote to memory of 1668 472 rundll32.exe 143 PID 1668 wrote to memory of 4072 1668 rundll32.exe 144 PID 4072 wrote to memory of 1172 4072 rundll32.exe 145 PID 1172 wrote to memory of 4836 1172 rundll32.exe 146 PID 4836 wrote to memory of 5064 4836 rundll32.exe 147
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#123⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#124⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#125⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#126⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#127⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#128⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#129⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#130⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#131⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#132⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#133⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#134⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#135⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#136⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#137⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#138⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#139⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#140⤵
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#141⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#142⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#143⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#144⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#145⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#146⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#147⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#148⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#149⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#150⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#151⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#152⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#153⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#154⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#155⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#156⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#157⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#158⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#159⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#160⤵
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#161⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#162⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#163⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#164⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#165⤵PID:5064
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#166⤵PID:2444
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#167⤵PID:1264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#168⤵PID:668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#169⤵PID:1804
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#170⤵PID:4196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#171⤵PID:3352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#172⤵PID:2664
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#173⤵PID:5108
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#174⤵PID:2996
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#175⤵PID:2992
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#176⤵PID:4024
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#177⤵PID:2400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#178⤵PID:2740
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#179⤵PID:3468
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#180⤵PID:4616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#181⤵PID:4956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#182⤵PID:4216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#183⤵PID:4892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#184⤵PID:3840
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#185⤵PID:3336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#186⤵PID:3660
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#187⤵PID:1564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#188⤵PID:1720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#189⤵PID:2460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#190⤵PID:1244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#191⤵PID:3248
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#192⤵
- System Location Discovery: System Language Discovery
PID:1088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#193⤵PID:5044
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#194⤵PID:4604
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#195⤵PID:924
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#196⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#197⤵PID:5144
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#198⤵PID:5156
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#199⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1100⤵PID:5200
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1101⤵PID:5212
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1102⤵PID:5224
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1103⤵PID:5236
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1104⤵PID:5252
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1105⤵PID:5268
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1106⤵PID:5284
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1107⤵PID:5312
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1108⤵PID:5336
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1109⤵PID:5352
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1110⤵PID:5368
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1111⤵PID:5392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1112⤵PID:5404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1113⤵PID:5420
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1114⤵PID:5432
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1115⤵PID:5448
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1116⤵PID:5464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1117⤵PID:5480
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1118⤵PID:5492
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1119⤵PID:5508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1120⤵PID:5528
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1121⤵PID:5548
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2345ImageApp.dll,#1122⤵PID:5564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-