209a4474cb7f906d4fd6c7df839841b7944b4917ec5f65bc0c92acfa552f9040

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 07:44

Target

$PROGRAMFILES/Bench/BService/1.1/bhelper.dll
Size

52KB
MD5

72b1a3d56f812839ae5ba3420a5ed812
SHA1

0fadb783c6c38284e5819bcaded2a1c50503f7af
SHA256

cc54e42139a9f01777833c5fbe9e545e008c74b6fa0abbc37d6d29d9976098be
SHA512

5bca01f36822e4345c792e9a65cb9823bed6ab8e7406906e089731c464056b9330dee014a968a5b4c069e72f682cf8167b131e6cc5cdb5478eb36aef6994b2b8
SSDEEP

768:/pPo7MYMiGRHPG0QXBfEte2LhTkk1qDJi22SvOUnDEDDmIGgEKA:0MYMieHofidTkepaFKA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 3144	228	rundll32.exe	90
PID 228 wrote to memory of 3144	228	rundll32.exe	90
PID 228 wrote to memory of 3144	228	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Bench\BService\1.1\bhelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Bench\BService\1.1\bhelper.dll,#1
  2⤵
  PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4100 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:3556