23c48717d3d09e0ed3c5903bb7fcccc81402f7b78b7f19fffa53e497e466a8b8

Analysis

max time kernel
139s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 18:04

Target

Modules/cus.dll
Size

102KB
MD5

afebf92fe3ceb4ad86cb806d6aaa0d7d
SHA1

1d9e7c4b8c1d938bca48dbb8edb53b6f34522ee4
SHA256

efa1abf8a7d331681a20739e362f8a0faec2fb8f8bcc7a7f2e4ba76147fbf4a5
SHA512

8c910f690f97200203fc4820d19a70bd51afc5e3bebeafe3107453eb6bc71166b152b3bb2f82586d3e06b9930a1be12daf43434ab763087792e3e468d563b581
SSDEEP

1536:J7PSVQhAoTtwAjjk2Ve9z7BvFjuJfCv6+LSEYxQcetvch89lVsmU79tjHOCshOi0:JD+807BvFjuJWVVY9ICshOIbZDa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1060	1056	rundll32.exe	92
PID 1056 wrote to memory of 1060	1056	rundll32.exe	92
PID 1056 wrote to memory of 1060	1056	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\cus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\cus.dll,#1
  2⤵
  PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4236,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:8
1⤵
PID:4680