6dc3e8f3e9d416228fc641e19080298813d2a8fcd2840e6b13282f754b79f5da

Analysis

max time kernel
139s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:23

Target
AppUnion.dll
Size 11.2MB
Sample240528-appnhsgf72
SHA256 7887d29cb9ddd14c46c43329dd56946bcad5d2c8d0998bb63df44b2a4f85bc87
MD5 94b2b17a8434fd1e8907e0c917d01aed
SHA1 6b3b19470bde1d0e51a9d998fa1ac747bb6ae156
SHA512 811815503ead796e3469995cc5227e69a0fd8b6635a3817408f965ab6c60c2490f67290d495709a6c8acfea575c613006d84f80cde4c289cf9157066ecaa4893
SSDEEP 196608:R7kO9ybKFxiYnr0tF8s4CvbktX5lKLE8+Ynw+gJanC:Rk6qKWYcGsZvMX5lKzHk
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 2668	4084	rundll32.exe	90
PID 4084 wrote to memory of 2668	4084	rundll32.exe	90
PID 4084 wrote to memory of 2668	4084	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AppUnion.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AppUnion.dll,#1
  2⤵
  PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3740