e5fb3ac8fb37b4bd895e282b5674725c9e0f2010b971899c61fd237b338c2707

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 19:17

Target

pcsx2-v1.5.0-dev-3390-g2c4af87e1-windows-x86/plugins/DEV9null.dll
Size

19KB
MD5

91480aafe388d3094ea970f3fee55808
SHA1

19bebe8df5cbabe0f2d03186b8bdaa7a3aea52ec
SHA256

3996d9651b65d9bbd1593b109e0ae1afde368b7b24a103428f2eccd007430cc0
SHA512

fbb3c74443a2d095328f69188a4ffd65a3b87ca293ceba5dd10e5c1821de49cbee63bb776d3e2ad7c698ddc7d14107049fa0c373c122710830b820c987c3c275
SSDEEP

384:LttGig7IQRpfRxJ08fXjiB/4bxryTqANlxf5:ptGihypfRxW8y/mxryGArv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 5040	64	rundll32.exe	91
PID 64 wrote to memory of 5040	64	rundll32.exe	91
PID 64 wrote to memory of 5040	64	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pcsx2-v1.5.0-dev-3390-g2c4af87e1-windows-x86\plugins\DEV9null.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\pcsx2-v1.5.0-dev-3390-g2c4af87e1-windows-x86\plugins\DEV9null.dll,#1
  2⤵
  PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4880 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:4728