f6de40a0e0c5b51daa70456189d10f7fc1e7dcd36168cf8afcb17035efda6686

Analysis

max time kernel
148s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 10:26

Target

host/wmpf_host_export.dll
Size

1.8MB
MD5

557263e28dc6c1416cea8b43a9a47282
SHA1

bb2306ef4e99dc0b10aa8ab51bb2872ed2a5d45a
SHA256

d40ebacc2c08b72aa48dbe613ef2bc4cfe65bf0fcd63254239308fc4ae0eb226
SHA512

b8fd24c566d770a452ecb5d227ccfe2ae8afc37d1c797d064adda63ec34a606c3ac882b2a366e4828c5c4869e249e2cf9dd9852185d63da9ff4bfc6c71c3d686
SSDEEP

24576:e+JpOhdC4YyHBU8p4aolR7esO2YgdlnL6tO/MbcTuMilTfYR01Is0B2o5pvy82+f:kC4YyHBP4DesjgsYOmP0B1i+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1216	1628	rundll32.exe	96
PID 1628 wrote to memory of 1216	1628	rundll32.exe	96
PID 1628 wrote to memory of 1216	1628	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\host\wmpf_host_export.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\host\wmpf_host_export.dll,#1
  2⤵
  PID:1216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:1332