184238497be5068f3544229b2d294552e4891248fc17468c85c2887118cea305

Analysis

max time kernel
1591s
max time network
1594s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/04/2023, 13:08

Target

Evon/runtimes/win-x86/native/WebView2Loader.dll
Size

104KB
MD5

9a5b63400b8f9758469627bbda1adad2
SHA1

4e14ff901760ac79879bd2a9d0f16e36999025fd
SHA256

464c49461f856c6d4ea995122e47825e7b600b88ff78c0592f56599cabd58084
SHA512

4108062abfbea5dd58e07e3dd504b23475bf098227fef50b9e849a747abd7acbff07669ef628d6937d118d3d379656c8145e0d726a52ecc2b12ec7a698e61014
SSDEEP

3072:PGlw6Jjqkv4KDRq5HdHHSWZqocPVTTEtOIp87eP3MlN:PG66hdcHdi7Et3pigclN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1752	848	rundll32.exe	28
PID 848 wrote to memory of 1752	848	rundll32.exe	28
PID 848 wrote to memory of 1752	848	rundll32.exe	28
PID 848 wrote to memory of 1752	848	rundll32.exe	28
PID 848 wrote to memory of 1752	848	rundll32.exe	28
PID 848 wrote to memory of 1752	848	rundll32.exe	28
PID 848 wrote to memory of 1752	848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Evon\runtimes\win-x86\native\WebView2Loader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Evon\runtimes\win-x86\native\WebView2Loader.dll,#1
  2⤵
  PID:1752