750c447d6e3c7d74ccab736a0082ef437b1cd2000d761d3aff2b73227457b29c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 11:54

Target

PocoInitializer.dll
Size

64KB
MD5

eb8c6b1f894093352397c7ae6a670261
SHA1

2444b43d851bf93e34c4282732875af66ee0331e
SHA256

9988bd57342edae24f6903b54e239b4b901b40c02c24c11552a8d20fc6207091
SHA512

bd258ab9b9bc7ad08b019e09ab1c7e182cb883e20eedd561c5d4a0d4e333c7d13ef14b1a6ad76c4207dc9d73a1562a4ccc1052e948a7bb9db03f887f494c3091
SSDEEP

1536:MimvYbkvGfnYP4+/okD0xlFjGBiaawZLkXOIYHrhg/QZE0X7QTHyb8:wYbkknYP4+/birfiLkXOIL/QZETHyb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 440 wrote to memory of 3080	440	rundll32.exe	rundll32.exe
PID 440 wrote to memory of 3080	440	rundll32.exe	rundll32.exe
PID 440 wrote to memory of 3080	440	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PocoInitializer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:440

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PocoInitializer.dll,#1
2⤵
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:8
1⤵
PID:1720