0d13dd9df82ec9d8b778815ae9634d8ab63a1facd76de25d406e33aa44b0aecf

Analysis

max time kernel
135s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 12:54

Target
$PLUGINSDIR/InstallHelper.dll
Size 320KB
Sample240601-p5e7cade87
SHA256 3507d6cd8472340f8a8d6cfae84370fa2b9a42114488720a4958d5a7fde0d1bf
MD5 4be1dc408cc08c562aa5d1dec0473d6a
SHA1 19558333e4aa11afeb9ebefe86247aee38264190
SHA512 1df0c384bfc70db083b1bae2d9ebd209c9e076e37bf47b33f1f277374ccbf29e04754388a7d5c0406237a7443567ec9cc274500e19f069a2d445f607751161bb
SSDEEP 6144:F3jxPxKh/ICK7eprXNSVeGqjBcvw40frIcDxG2lKi:FTxPxKiMX+Utcvl0jIcDxG9i
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 5060	4740	rundll32.exe	91
PID 4740 wrote to memory of 5060	4740	rundll32.exe	91
PID 4740 wrote to memory of 5060	4740	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallHelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallHelper.dll,#1
  2⤵
  PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5060 -ip 5060
1⤵
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4144