fc16a73ee55b2a601b923eabf03c28180a7345f2d4e1da7dcdc9716a03ed5aa6

Analysis

max time kernel
147s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/03/2024, 10:40

Target

res/driver/google/win10/i386/WdfCoInstaller01009.dll
Size

1.4MB
MD5

941118a852afc3c8f9544caa9d7798af
SHA1

01005ac13cc159bb4f45dc8d78f19c7a455b639d
SHA256

b15f62ffb36c5f8d86ddcc92e24ca7b3d3ca05f38815a371fedbeacc32358c47
SHA512

f8d34d9bd727216ea577bc971999545f9051bb6b94ad690ce1bccf8b6acfc55c5f185d527db436aab5e1811d47450becec192fcfa8dcdeb97d099b9b8ebb4f10
SSDEEP

24576:ejG90oN2lj11mk/22yYzGrarZRm4X5Uh6rVh5LdfBwOyCSQM1fFhSWRA7zq:aGtN2h1120R7m4XShYVxfBwrC21fXS4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 4344	1300	rundll32.exe	81
PID 1300 wrote to memory of 4344	1300	rundll32.exe	81
PID 1300 wrote to memory of 4344	1300	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\res\driver\google\win10\i386\WdfCoInstaller01009.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\res\driver\google\win10\i386\WdfCoInstaller01009.dll,#1
  2⤵
  PID:4344