06aa393ec4cef895ebbf9923200f9f5d71df6ae27f091004c89176a92825014f

Analysis

max time kernel
133s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 22:39

Target

$_1_/Modules/wis.dll
Size

42KB
MD5

875b93e5075b75fba8b080c578e9170c
SHA1

3e04baed759bafcf80a3edc7f16054739ceb1972
SHA256

3a942e2bfd313ecdbd48ebe05653b50d904f9b1dc30c86067446885a8d01dff7
SHA512

54c008a278de9fe898cc661393df22b62be9dddd31ab910e311a52ab7035b93949baeba7ff4fc40371061bdc6d9ac9ebc6dc5cd6e31050b44964e172162f6b89
SSDEEP

768:TkPmePU4gW1YH7FzxIT7JOB3+NI2giTcsuCGkjam54RZcCTRUf/HXNJxriD:TkPmePU4pKbBKT7JOIu9lUOsWZHT8/3g

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 4264	2036	rundll32.exe	90
PID 2036 wrote to memory of 4264	2036	rundll32.exe	90
PID 2036 wrote to memory of 4264	2036	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_1_\Modules\wis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_1_\Modules\wis.dll,#1
  2⤵
  PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,16488180140590516186,11762960689811837350,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
1⤵
PID:4816