10d7316ef9c54377354243744d16882e92cb97c4310eaeebc3f583abf5f9214c

Analysis

max time kernel
1790s
max time network
1805s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 14:44

Target

EraRev_Launcher/Client/Microsoft.VC90.MFC/mfcm90.dll
Size

58KB
MD5

d4e7c1546cf3131b7d84b39f8da9e321
SHA1

6b096858723c76848b85d63b4da334299beced5b
SHA256

c4243ba85c2d130b4dec972cd291916e973d9d60fac5ceea63a01837ecc481c2
SHA512

4383e2bc34b078819777da73f1bd4a88b367132e653a7226ed73f43e4387ed32e8c2bcafd8679ef5e415f0b63422db05165a9e794f055aa8024fe3e7cabc66b9
SSDEEP

768:kXS5hxqhOz9XNpOb/AXVuips6Pm550971BVO5nkcwo5ArrwlyQ6mrCHrO1MquTSU:kC/IMZHO0lu+s60VwvrrDmrCrO1HuTR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1280 wrote to memory of 5008	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 5008	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 5008	1280	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EraRev_Launcher\Client\Microsoft.VC90.MFC\mfcm90.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EraRev_Launcher\Client\Microsoft.VC90.MFC\mfcm90.dll,#1
2⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4444