0bb7e3c0492d977fe3b32844b0bccec70a808c2f7a2e36ab0942ed8101d54783

Analysis

max time kernel
111s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 05:11

Target

SDL_ttf.dll
Size

165KB
MD5

57e661eb0715dc77a60f344e9ab5d8a2
SHA1

8d46b913112bf339c0cb202c7763d02369954119
SHA256

b2750edd981056708f33e1046dafe6d45bc82eb78636ecf368de898503769f59
SHA512

af66c0ca6e546626aee97e0843abe51e659a86a7e59fa478f20943e7d39432e4121d119d6d9b2d069f9b44ba4e3b735f775e231f72e541174b50d9a238914035
SSDEEP

3072:t5ufy6aMFaNJ23Hbps9SzlvWJ3w6jCc0v7JCTYRcVQQY8bem826vfd8093N7XFJJ:tsdaMFG231seluJgTXyVQQY8g

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4068 wrote to memory of 5072	4068	rundll32.exe	rundll32.exe
PID 4068 wrote to memory of 5072	4068	rundll32.exe	rundll32.exe
PID 4068 wrote to memory of 5072	4068	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SDL_ttf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SDL_ttf.dll,#1
  2⤵
  PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:4648

memory/5072-0-0x0000000001430000-0x000000000146F000-memory.dmp

Filesize
252KB

Download