a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100

Analysis

max time kernel
139s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 18:44

Target

gspfxt2/XTRAS/FILEIO.dll
Size

86KB
MD5

a2fe4d84306cc533baab98d2a885be66
SHA1

b6a339b9bf62b9cfd1911bb321cd7040ccb504aa
SHA256

09143700bb9f243dc01399f5992b746c5ac41ca03d5df08c6290fc8150e02cd5
SHA512

68a5d106896b055872229a15e46b61354cded43ba9ff6347eac058e980ee5dc8d74842c17e38cf8f85d14668fa09d6f131d03abf425489330d0c59d319b98ea4
SSDEEP

768:0DCRhOO8q89Ya7ih9qsGrD1E4NpsmlWqmMA4XP3Be5hIUPJ2+d2MQaAAe:0OHOOq9Ya7u9OiwnlYMAK/BORd2M/AF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5032 wrote to memory of 1080	5032	rundll32.exe	rundll32.exe
PID 5032 wrote to memory of 1080	5032	rundll32.exe	rundll32.exe
PID 5032 wrote to memory of 1080	5032	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\FILEIO.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\FILEIO.dll,#1
2⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3944 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4900