20a482d03485031a84636bc19152f63564cd2bc3eb10be1023c2e51126686106

Analysis

max time kernel
125s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 18:13

Target
Modules/cus.dll
Size 102KB
Sample240510-wt4h5adf48
SHA256 efa1abf8a7d331681a20739e362f8a0faec2fb8f8bcc7a7f2e4ba76147fbf4a5
MD5 afebf92fe3ceb4ad86cb806d6aaa0d7d
SHA1 1d9e7c4b8c1d938bca48dbb8edb53b6f34522ee4
SHA512 8c910f690f97200203fc4820d19a70bd51afc5e3bebeafe3107453eb6bc71166b152b3bb2f82586d3e06b9930a1be12daf43434ab763087792e3e468d563b581
SSDEEP 1536:J7PSVQhAoTtwAjjk2Ve9z7BvFjuJfCv6+LSEYxQcetvch89lVsmU79tjHOCshOi0:JD+807BvFjuJWVVY9ICshOIbZDa
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 936	1528	rundll32.exe	89
PID 1528 wrote to memory of 936	1528	rundll32.exe	89
PID 1528 wrote to memory of 936	1528	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\cus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\cus.dll,#1
  2⤵
  PID:936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3624,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
1⤵
PID:2688