134c5d1acefee78416ad78742e402a3992bf3ab31ce21a7c3bf07cf4e182ef22

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 16:11

Target

$TEMP/$_85_/InstSupp.dll
Size

365KB
MD5

8f11c131cfa10a7f4df6713a600edc4e
SHA1

f778dde4e4e07c2851787aca0d9599bacc89d112
SHA256

6b983cb710acb18c3f41fb0b0593a437f824f467adbdbcaee754bb78b7a10493
SHA512

e1a1841a3f45aca5c641440ec4ccb371d3f593d6e7b31dacf0072efcdecddc845ac54344be196404e0e8bba03330e1d02b07d3a3637c3bc1e5dc30eddd72aae8
SSDEEP

6144:oax/t+8HtpQhakvZpS6IkOrwESznfzQq7aHG/coYbioVm/Pg/Jm8ji:oaJNpJkxpLIkO0ESzn7J/GiuEPH8ji

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 3544	3484	rundll32.exe	91
PID 3484 wrote to memory of 3544	3484	rundll32.exe	91
PID 3484 wrote to memory of 3544	3484	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$_85_\InstSupp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\$_85_\InstSupp.dll,#1
  2⤵
  PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4620