809eb0570ba5abcd4ab012b354b4e1f0311eff595b1988ab0735bf1ab846e632

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 14:04

Target

AptSpare.dll
Size

405KB
MD5

bd941e566e6eed6875560461f6c3e16a
SHA1

80066e6e93f5d7664ffeb1f9806041f2ef88a754
SHA256

a2614bed2fa14bb06d7d12be7c3c2934daf3201fb2b962c7adaee26c0cb1f4f8
SHA512

193eabea05f9a2bddd15c7ac8afe3c3198c1589b2deb728cefbf74565ecd3e7242bdf63dcb76cc4fc6bc8ffee38d22a7e2af5edc058edc458d4f47072a7f52e7
SSDEEP

6144:nAIIFAYzYF9CLa/GzrQBN22gDdP76XEx40e/Ixn9dVM45uJIZkNehX:DIvzYF9Ga/oWgDdmXEx40e/m9drEyDhX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 1152	4964	rundll32.exe	89
PID 4964 wrote to memory of 1152	4964	rundll32.exe	89
PID 4964 wrote to memory of 1152	4964	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AptSpare.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AptSpare.dll,#1
  2⤵
  PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:1728