24d2f00a1a35b70aaa6ddd836e6bb52c8d68953e81ab478e58f1a85375ceaf97

Resubmissions

12/05/2024, 08:14

12/05/2024, 08:10

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 08:14

Target

idle_master_extended_v1.10.0/Languages/ko/IdleMasterExtended.resources.dll
Size

9KB
MD5

c1fa73556902fa83403777705a038505
SHA1

39747f0860ef5c7ba2ce70dadf348667c8f459be
SHA256

64671c2de7e28041591d802a275c438fd74d31b5320a4454be0a00d9977725a8
SHA512

741ec25461e5b6745b55dffc698c4b5f6a4761d4d07d12d886861942428928962bd28a8f2dc991d974b7111bac4cc575ca79ed9c26b17342b5fb6a8af54063d1
SSDEEP

192:IkcayCzg2N8Dhrnwh9mu2OHiMxkedti2XweHi:IkGj2N8DhI9mrOHiMRdOV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4960	4832	rundll32.exe	91
PID 4832 wrote to memory of 4960	4832	rundll32.exe	91
PID 4832 wrote to memory of 4960	4832	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\idle_master_extended_v1.10.0\Languages\ko\IdleMasterExtended.resources.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\idle_master_extended_v1.10.0\Languages\ko\IdleMasterExtended.resources.dll,#1
  2⤵
  PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4052 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:3260