fd458a3b3bd8eb56e2af627e877e11b8fb9d0d4a731e262ea0ce44f0b9586de6

Analysis

max time kernel
139s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 04:08

Target
Data/SDL2.dll
Size 1.2MB
Sample240605-eql18sdg3z
SHA256 f70051e79801f33793090ee0e99d8d57cb392121064dbe0a6b66b375e3f9b6ea
MD5 3f25925f454362a61705694be43b62c9
SHA1 5794b736c9342b9b4c2e91fd2fc580e87d168664
SHA512 0e7bdb14078125146a00b487db2778ab30901ed121b9b7a9bce3f9e077acb9860c206be44c2319567eb04091744516e8d7b240c4d02f27da517e642c48ffabdb
SSDEEP 24576:IYNlQTkQrDqBSzscm0fP12fOmkBBeb7LVNpWAJqiuv0h6Llefgwn0TSfMY3TCos7:z+WOsc7RsdE9RLa/r/fHc/d/xHq/z/Xs
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 4532	636	rundll32.exe	92
PID 636 wrote to memory of 4532	636	rundll32.exe	92
PID 636 wrote to memory of 4532	636	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\SDL2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\SDL2.dll,#1
  2⤵
  PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:2348