27bf8e239f59a87c27cc9d1c7e92adece25427d246cb5c04fa0237930181fea9

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 04:47

Target

$R2/SDL2_ttf.dll
Size

51KB
MD5

bde2495fcd5ab9b2429f4c51055699f4
SHA1

02f8092bf3b51550bb5d1bd78e0e145df7e984dd
SHA256

7bf81e336da6f06320daeac031bfc28871feb77c489d3f75f88e7a1abea712f3
SHA512

9763b517f5bde7e21ece58669b26df6e322dfa786ce6a527a36e3241923285080af4df7e5588a671ddc81328b01251128bc324587bcd81ae5059031ce416fe32
SSDEEP

768:gXqzg+wMb7rTN5phhvePcw204Ha3MGtrcitaVzQmacAEeQxVemu1clBzI3sk:ge1HXrR5DhWPcwkHa3Mlk5Q6mu1cw8k

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 1188	3696	rundll32.exe	90
PID 3696 wrote to memory of 1188	3696	rundll32.exe	90
PID 3696 wrote to memory of 1188	3696	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R2\SDL2_ttf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R2\SDL2_ttf.dll,#1
  2⤵
  PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:400