909df004857e854a646328179d73a9738eec6b2eb559be3b0cd8d3c53b3dd29a

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 05:06

Target

AntiHook.dll
Size

81KB
MD5

c2e4d3e917cd8f3983081d1359feed43
SHA1

d25579acab98730a0c02b2700379359caeeaebcb
SHA256

88606f749a308e0754ea0b7bbc349c843a353bf24822f416c7753024073e7d8e
SHA512

cc4a0a52dfccabdad0e6d82c81c62dea022f8e86cf85e57f684baaac29e74cfb95ef94d6a41c374176122904eacb478a383f67d8b2f207be70a2fac0feb49f4c
SSDEEP

768:a4B5KkQMvIMGq28nGxubTTZkC1KpEwGJ3/3SAGcSTKCJqXalmz5k93RTXn4LZb:a4vRQzsNbTTBKy5+W1qlm1kRR7n4h

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 556	208	rundll32.exe	96
PID 208 wrote to memory of 556	208	rundll32.exe	96
PID 208 wrote to memory of 556	208	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AntiHook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AntiHook.dll,#1
  2⤵
  PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2824 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:4164