b75ff60aaccd7c025a5a2d27afc266bf23808cf46840a4bc868859f0902e09a8

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 15:27

Target

TwistedBrush/_ISEffects40.dll
Size

335KB
MD5

6e130953423f7c6ad633510a10e9b21f
SHA1

293c9d68464e530ee52987ad4622d93471103758
SHA256

712d653c5da7dd13d7b2af85e1e8c86ba0a43248947b77f5a6559dd774ce54cc
SHA512

8c7f75bb1ad7ff1b1355e445b50008df5208603a75efdc8c18c358e3dd9fb599efee210aab4e9964601777c8c116a3de302e94e3dad56129d40afafa2308bb91
SSDEEP

6144:NDfh9T6sAknHF8TZkUz34jjBSnxZ1OXbZfetU7TUm2j712I1CnrHdACLE:Fh9T69TZN3MjsnIlfeCUm81xCnr9AX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4860	2804	rundll32.exe	94
PID 2804 wrote to memory of 4860	2804	rundll32.exe	94
PID 2804 wrote to memory of 4860	2804	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\_ISEffects40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\_ISEffects40.dll,#1
  2⤵
  PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:8
1⤵
PID:4532