5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 10:49

Target

Plugins/FileView.dll
Size

168KB
MD5

57553f9302b159abc002cbc0f6d64163
SHA1

a295fc11c0ef0f35992412fd10b02c93d77a92b9
SHA256

c922ee6dd39574e64eed027cba93d0a2edbc29cfd1993d9b6ce84de27324cb54
SHA512

5b05d0c48b5429cd5b77905798b1031376c41745113b0bb954a4b92b371b12e4125bca04f74086a686bb2abf74d06685001654d5afc23b680ae6da395e14ceda
SSDEEP

3072:45Ob10FBT4TOsPxO9Rj3rwKPWUwI1SFlFnbWubPJi20HQwT2qelY4PoLalzip1Ie:4QW4TNxORjbwljE20/2pY4EpfbI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 2172	3964	rundll32.exe	91
PID 3964 wrote to memory of 2172	3964	rundll32.exe	91
PID 3964 wrote to memory of 2172	3964	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FileView.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FileView.dll,#1
  2⤵
  PID:2172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4420