cde7fb1f8bd8f784a0a0d481c588ab3f6b86213b3fc0fb014c07cd4f61ee89a6

Analysis

max time kernel
132s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:36

Target
uptools_4.1.10903.1/XCGUI.dll
Size 1.8MB
Sample240603-mnqweabe7s
SHA256 096a0684d5d831ed2c9acd96aa881819c56d9b1c42389b9685b85f51d843a4b4
MD5 f81ed50c4bd3fc0d7e88436dc1a43829
SHA1 968d78287a06ddd08acedb64d24ccc1f8691a076
SHA512 d1a64bf68eecef9f14f83241129a9b644194bd19baa03f1fc88b7c9c4f5ef5502e93551939f36760cda559d3395c8517c2b9df87ec1462d4f6bb49a91c146f07
SSDEEP 24576:aHvTBp28HC6rrvbqZdHM5FUtwMloeJMpE6LQ0qZTpRm9vMaUw+6zQT9ZUQRzvgk:8v/rr7UmVeJwURl80aUTqQTTUQ1g
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 3580	1092	rundll32.exe	92
PID 1092 wrote to memory of 3580	1092	rundll32.exe	92
PID 1092 wrote to memory of 3580	1092	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\uptools_4.1.10903.1\XCGUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\uptools_4.1.10903.1\XCGUI.dll,#1
  2⤵
  PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3444,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
1⤵
PID:4072