a785881a9cadb30202026191d72c14636053f85f285027d48b80824240c20025

Analysis

max time kernel
113s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 06:27

Target

$PLUGINSDIR/ZjROYGvOsLF.dll
Size

1.1MB
MD5

33aa214d2292caaf0d79c1a7d11c3ef8
SHA1

a2588eb18990e4a1071297bfe68bbc065d659e8b
SHA256

2a740cd71da20164f5c50db5ecf421194276618c871552f97977aeba6f3c61f2
SHA512

934d1aa3f99f68577dacc95e217f4239750124cd3a4cbbc642fe6ffae1531829936ba0c0a1b70a328460cc8f394934cb595ad51065d631cc7ec113cbea96618e
SSDEEP

24576:/BFIiefwpioUZq9L8S3Ck4/HOW+mmNYhxY/jrLpushnQDbOEZlB6e:/T1UOW+mHhxY/jrUsiDbOcf6e

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 1368	3968	rundll32.exe	90
PID 3968 wrote to memory of 1368	3968	rundll32.exe	90
PID 3968 wrote to memory of 1368	3968	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZjROYGvOsLF.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZjROYGvOsLF.dll,#1
  2⤵
  PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4832 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:4740