112468aa12933ad14bac5eaf5195b51f06546af9b37adfa64cfcc59273174a8d

Analysis

max time kernel
124s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 12:18

Target

Modules/CdPrc.dll
Size

90KB
MD5

ed6a77a75c81e03e58ed476b2e6a7147
SHA1

88cd0dc4157779d5873c6a3963b462385db2e47c
SHA256

c19cb3bd01dffd50c293db26e4a4acd08b91921ca28dc17f221d9dda45d87754
SHA512

ca277bc6666b92b3a13818237c78b51019eb2fef31e0b319bf0905d8f4914d2431496ccd5f84d5a4e38bc4be39de7a20dbf9632e399101e90d2bcbe3b6496f31
SSDEEP

1536:uX7wnCjGy1zLNbTVyxFQQgwyJ3lKDmPOXQtsWhDgI5wWdKBsD/c3bUHTS3ix:ur5GydTV0QQglJ3kAtsWhDgVWdKiD/ck

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1264 wrote to memory of 1952	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1952	1264	rundll32.exe	rundll32.exe
PID 1264 wrote to memory of 1952	1264	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\CdPrc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\CdPrc.dll,#1
2⤵
PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4080,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
1⤵
PID:3888