50a8a27c3936baf64013435a27409f53abb3376327dbeef67aeadcfc89f70093

Analysis

max time kernel
144s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 11:37

Target
$SYSDIR/wpcap.dll
Size 228KB
Sample240315-nrdwpafc6y
SHA256 ab1bf7740115d2930377a17e41d7f685acf51f128405dde228e492de6ce82725
MD5 0a478ea707f567efa7f31847dd0e9928
SHA1 7748e0d84fb2cc170d46d009250a5762e3a6b9f0
SHA512 4c447f53437b8e9a3f974a25b0b992ace066c9d0c1e2449dc65960cd7de8560ff74e5b87e610f32c46e3712c46070975135d088fea2ae7c1c94b7225a6cacac9
SSDEEP 3072:lgi3NhAPjs28YteNNlxRb1jnNMySEeuFtxTT4Il+c11zF1:lgiz2wNlXhnNMjruFtRTJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2520	2020	rundll32.exe	96
PID 2020 wrote to memory of 2520	2020	rundll32.exe	96
PID 2020 wrote to memory of 2520	2020	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\wpcap.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\wpcap.dll,#1
  2⤵
  PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:2256

memory/2520-0-0x0000000000CE0000-0x0000000000CF5000-memory.dmp

Download

memory/2520-1-0x0000000000780000-0x0000000000790000-memory.dmp

Download