55aa5ea3f3aea2186f963209015fe71f37244df3149661746f1aaf7545fe95fd

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 13:47

Target

Geode.dll
Size

7.5MB
MD5

e5ce38e49a3e32be6e04afa0ee5aa9a6
SHA1

271f7f35264c68ccdb29a69e67f044fbeb0f1c2d
SHA256

880ad028b514d58003a916b7eca71c36a2cd8cd87c5e917319ddd74670c5d4d1
SHA512

a40a0c1a64591a3a4aa051fca722913ea922239b16f0745816e159adec4add1f6b58dd7188576d386b5a19aa99b751429b80cd6e8034959f9e312d63b0d54433
SSDEEP

49152:qJMDMcG9YiqnQRCkuR+KATaUGnjlmpdXdIO7RAJv5pAQ0HLPTNqdzO7+1MctuvZQ:b69enQRMwXfRAJvN0rpqdzO7+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5060 wrote to memory of 1324	5060	rundll32.exe	rundll32.exe
PID 5060 wrote to memory of 1324	5060	rundll32.exe	rundll32.exe
PID 5060 wrote to memory of 1324	5060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
2⤵
PID:1324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4456 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:3700