8398f9158dd22bfb3d847b38495a2720a73d83df4dc8c332837c97282cf56b98

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 16:42

Target

scripts/wDSound.dll
Size

52KB
MD5

57284324df4d261aaa9f75754c55b476
SHA1

0f13ccd5e82992e4cf03c886255e11ac2a58cd98
SHA256

f3f119285a2256a94809308902353837ebecbb1e80156506d47df2d679a43b76
SHA512

4094fc5e7d2cb029f5e480758329f3d70063f6eed00d26abffcad3afbba972b97e5f76c3edf106e6abadbe2a9a2c017e015ba672daab05cded3fb9117ccaae59
SSDEEP

768:2yl95+2LT9xgycIHhynyKZnT61Ncbdwllw28ZG0Ut1H+BMWMmqgSq:Fr5xxgycIHQyK9TkNcZwll4HUt1jmHS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 2144	4876	rundll32.exe	94
PID 4876 wrote to memory of 2144	4876	rundll32.exe	94
PID 4876 wrote to memory of 2144	4876	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\wDSound.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\wDSound.dll,#1
  2⤵
  PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:2560