1088c38976f5a7f857f502deb9e0bba7faeb962df17555a212abb4341774d4a7

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:24

Target

$PLUGINSDIR/BDLogicUtils.dll
Size

904KB
MD5

05ca3b250b1108f1f64c2771cf25a9b6
SHA1

bc55d0b260cd5d0c10af1afefe85c33668478da6
SHA256

bd6ad4e0efa74f2d47aa3efe24f5b73ded46abb78feefad5269dd71e44247450
SHA512

8e223086841803b5208597316d88992b74bdcf581edc683ca9c5fc5624d7faf994921685c99cc778cfee90329109e0c4c4daaf070d1cc1cec39e435a3bfc302f
SSDEEP

12288:8NHcSUuN2kegPu8j/C8eiSK+2FMymFpbN7ozH0g9VhtCewWTVZO91f7yPh:8NkN8ukCniSBymFdm7CewWTTO1fGZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4844 wrote to memory of 4344	4844	rundll32.exe	rundll32.exe
PID 4844 wrote to memory of 4344	4844	rundll32.exe	rundll32.exe
PID 4844 wrote to memory of 4344	4844	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDLogicUtils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDLogicUtils.dll,#1
2⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3600 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:3200