01f5be143241a7a1ae1904e167e3bca53e247fce8fb008879d6598dd8d642332

Analysis

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 11:54

Target

DeviceDisplayStatusManager.dll
Size

29KB
MD5

0d2f1a770369cc1ff62f24ce2d05e7c7
SHA1

64711531c3800b1151f23f5a914d53a631a6db25
SHA256

01f5be143241a7a1ae1904e167e3bca53e247fce8fb008879d6598dd8d642332
SHA512

cb435294481db36a99bfb699e763eb05ec7c6555906f748a958c48d996b1c3e28698f2b81df09b47551c0bffe58feee505dbbe7d9973a06b2f3952c2cc62cfa0
SSDEEP

384:3AtZM7ob9kI+A8BhlikVo2XLUXU9r31CnCxSzM8Mtwx6zqVdZFxfOp0dPQWQfWVX:QaohkDHDPofE971XxvRqzZVPa6ce

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1536	1348	rundll32.exe	90
PID 1348 wrote to memory of 1536	1348	rundll32.exe	90
PID 1348 wrote to memory of 1536	1348	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DeviceDisplayStatusManager.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DeviceDisplayStatusManager.dll,#1
  2⤵
  PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3960,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8
1⤵
PID:3652