081b2455cbf464eee43082d023137137eaf43b7a6e1f475feeb75b7cdaaa4cac

Analysis

max time kernel
138s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 01:02

Target

Sora - OpenAi v1.1/__MACOSX/ext/php_gd2.dll
Size

1.3MB
MD5

6b5a11b8724dbb00f921d0d3adddc0f8
SHA1

16736b897a691c1298eca0a9df70a82eac69c7f2
SHA256

ddc10933f9d057fbb929f59997f5913182ce928dc8ffad8963eed74c2ef50256
SHA512

729c2cea71d89177473f738e0b342817ce12508dde857b5eb1226ab7fb90d4c64a777a9ed04b083ce57c9129da916e062b1084ee93058593e99487ae4eab4da0
SSDEEP

24576:DYRTpO+VefFtu/olxF/7AhMDMo+qeLdeYc4w8/sXhaLHZM+o:eKLU7hS+HgYc7B

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 2240	4020	rundll32.exe	91
PID 4020 wrote to memory of 2240	4020	rundll32.exe	91
PID 4020 wrote to memory of 2240	4020	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sora - OpenAi v1.1\__MACOSX\ext\php_gd2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Sora - OpenAi v1.1\__MACOSX\ext\php_gd2.dll",#1
  2⤵
  PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2428