a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100

Analysis

max time kernel
153s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 18:44

Target

gspfxt2/XTRAS/JPEGIMP.dll
Size

91KB
MD5

bf3b59831227155d61f35b1580a09c6d
SHA1

6cfbf657b8432960eb4429f0bedfb31f4f3fbb6c
SHA256

dd72a260a01d177b29febabb894e3e7ed9458204a2d645c1b69b17f4e9676928
SHA512

e742f4a92ba1020ddc7675d2b559c0ce5855d0073168178b1d0497b25c3a5f2a68db5d49c648dfeaa3274991ea6471d623b00ca2bbdf2996370fade04934d632
SSDEEP

1536:uTmqHlaL0TFI51YaX88CPA7t8h+gWROOdC6bIHFn35Bw6/kGUHM69Sdm4Jnpy:r8pKLJ85utPvd5bqx35ncGy9Sdm4Jw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4712 wrote to memory of 2920	4712	rundll32.exe	rundll32.exe
PID 4712 wrote to memory of 2920	4712	rundll32.exe	rundll32.exe
PID 4712 wrote to memory of 2920	4712	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\JPEGIMP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4712

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\JPEGIMP.dll,#1
2⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:2480