2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 16:52

Target

x86/plugins/HardwareDevices.dll
Size

157KB
MD5

7c35a25859271e4550580a5b6ec769fa
SHA1

b99b6c10bc2b95cbd5270ca7549f54b5d69f8eb2
SHA256

e0c91ad1ead26ba93257059b5a7600c6fc3baf3278499d850e9e884fea409761
SHA512

c5d93b421a0a63c6c7fbf5684716c967d5176115627291ae680225b091c570ae53eec17ec306451a810432fc96b3c833294a62de67b2b5bb5df0e0c5fb525f4d
SSDEEP

3072:2ELgmODhaGSOL6YBpBZilmm9/tfm9V5OrIkPxXSm4TRs8pPp/Batj:2ELgmODhaGSOL6YBpBolmm9wUrRxI37Q

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2608	2540	rundll32.exe	95
PID 2540 wrote to memory of 2608	2540	rundll32.exe	95
PID 2540 wrote to memory of 2608	2540	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\HardwareDevices.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\HardwareDevices.dll,#1
  2⤵
  PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3952 --field-trial-handle=2264,i,7010714054498059916,1862725710331979271,262144 --variations-seed-version /prefetch:8
1⤵
PID:220