ccc22bb5b661a3106558dbaf94ee9cd02b31b83ca3191f0a5290b53d02b64a29

Analysis

max time kernel
149s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 01:53

Target

About/Microsoft.AspNetCore.Razor.LanguageServer.ni.dll
Size

3.0MB
MD5

da063aa4dc6c8d0ad11ac8d6a7c27168
SHA1

ab7b15da4271c63693299c0287617c003caff046
SHA256

d4964fc3bd16cd707939e8cfe6d2880a8d3cb83633a12a4253c6372e57768a76
SHA512

80c54046dd3aff979ed8e32d0b0b2d0d8f161a3a8e79a35d9eae4eeb9fb4de633ed6847562a0c8ca966b797a32434f8a49e935ed59f2250376ca3ca3fbcb6db8
SSDEEP

49152:8+FyvGymUYtmaRcMJYHkyvLyJAlUMlfJmJMxPsObx0zzk5mjT23rb:8qRUkyjyJ7Ml6Mx0OF0zo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3212	4556	rundll32.exe	89
PID 4556 wrote to memory of 3212	4556	rundll32.exe	89
PID 4556 wrote to memory of 3212	4556	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\About\Microsoft.AspNetCore.Razor.LanguageServer.ni.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\About\Microsoft.AspNetCore.Razor.LanguageServer.ni.dll,#1
  2⤵
  PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:3408