737b556d3b68ea3bc0ee44dee71e26657802de630e039193e178a4d975c44187

Resubmissions

10/03/2024, 09:40

10/03/2024, 09:34

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 09:34

Target

App.Setap/locale/af/LC_MESSAGES/plugins/audio_mixer/plugins/audio_output/libdirectsound_plugin.dll
Size

51KB
MD5

077990f957556e8a72a37f0ee09a2083
SHA1

371908e5515adb53a57f8d2bda47d59a7346fc1b
SHA256

412f9ec13da17b2f2269567b8397b587352070ce77a641ae40b7a243e26c57ef
SHA512

420d536532ccd474176e2ad2421e655708e0835faa1a60f9b2a70f8a54fdd8d787567c30f478639a367d913b5b34e4e0a81c1c38d95d14351affb25abc536770
SSDEEP

768:htDcW2X9vjCOdZLae3hhwoOzHtdvQEarpDGFhcs3yDGFhed4:ht+X9vj/tJOYrVs1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 3988	2536	rundll32.exe	96
PID 2536 wrote to memory of 3988	2536	rundll32.exe	96
PID 2536 wrote to memory of 3988	2536	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\App.Setap\locale\af\LC_MESSAGES\plugins\audio_mixer\plugins\audio_output\libdirectsound_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\App.Setap\locale\af\LC_MESSAGES\plugins\audio_mixer\plugins\audio_output\libdirectsound_plugin.dll,#1
  2⤵
  PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:4940