24d2f00a1a35b70aaa6ddd836e6bb52c8d68953e81ab478e58f1a85375ceaf97

Resubmissions

12-05-2024 08:14

12-05-2024 08:10

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 08:14

Target

idle_master_extended_v1.10.0/Languages/cs/IdleMasterExtended.resources.dll
Size

9KB
MD5

d77236bdb0a5ef56d3584441aa1b6882
SHA1

1252d5d1344df879e00203724f28f13cebe11632
SHA256

3943cf7af37a730c53120919c8ebb64d6c0a69b43049639aa425281c6d0af534
SHA512

49b710f14581152ea7f058184d12c2c5973d6297df886bba74051cd9462a8eb94289db98f8ae635638c17b0e497ddd3992ffecd94a7f98097229b2b5d7db88f1
SSDEEP

192:YicayCznB1L065rw/VS9TkBfRoEI/EGFo0qY4iiqaPeHi:HGczg65uVSIfRoEIXHqFV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 1300	3096	rundll32.exe	92
PID 3096 wrote to memory of 1300	3096	rundll32.exe	92
PID 3096 wrote to memory of 1300	3096	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\idle_master_extended_v1.10.0\Languages\cs\IdleMasterExtended.resources.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\idle_master_extended_v1.10.0\Languages\cs\IdleMasterExtended.resources.dll,#1
  2⤵
  PID:1300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4232,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
1⤵
PID:3844