d428e48a77074d621d8a375f6130e3d85b82097d6d0cc90b030557388bb9b313

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 07:39

Target

Accelerator.dll
Size

306KB
MD5

091f0da49c9fe3f5903fa46638017442
SHA1

2c3627308d0741f4c517fdadbd58bbb0398518ad
SHA256

34c5416f4261f76103722ee86b9dcadc7ebddb2b4ee1d49a7eca914c2b343141
SHA512

e651a615a714822e4f036ca6dc79bc6a01a023f681a825f8d35b0cdd5293f80d51eb41bf14ecfb59f49cdbd8867df8e784118e1a504eebf394ca25c7987a63bd
SSDEEP

6144:I2GMn+qaIrAf4pd3DecSGUHmJYSJuXEj0j888888888888W88888888888I:D3+yt8SYiuc0j888888888888W88888g

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 3188	2076	rundll32.exe	90
PID 2076 wrote to memory of 3188	2076	rundll32.exe	90
PID 2076 wrote to memory of 3188	2076	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Accelerator.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Accelerator.dll,#1
  2⤵
  PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4036,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:8
1⤵
PID:2560