1f733a59d0984b6eeeafc88b72d148840cbc52fedb0c73655bfa329a6fe97101

Resubmissions

10/06/2024, 07:52

10/06/2024, 07:09

max time kernel
235s
max time network
272s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 07:09

Target
AROTutorial/aross.dll
Size 20KB
Sample240610-hy44kaec89
SHA256 22f591d6df14cc97acd2922cb4f63479e080a3760e750ee34ffd1890e29745a4
MD5 69b34eeaa93884d81b1445a272cd27df
SHA1 a10312b366b76d39d45d571ed37e6768ab1429df
SHA512 20872067ed4617a1b5ccb27202b783df8edbee210cd699efb092003ab24eabe4a4cd81149064ffcc231bb16745908a93721fb299b4dc76643d674681d1348a47
SSDEEP 48:SpWIVblx09ORiHrazTSyVaYncTd8cVjYG4gh/CDtx+r2rOZAe6N7pqRq:2svHrYTfE4cScChxuZ+7z
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 1496	660	rundll32.exe	89
PID 660 wrote to memory of 1496	660	rundll32.exe	89
PID 660 wrote to memory of 1496	660	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AROTutorial\aross.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AROTutorial\aross.dll,#1
  2⤵
  PID:1496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4256,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:8
1⤵
PID:1016