e5fb3ac8fb37b4bd895e282b5674725c9e0f2010b971899c61fd237b338c2707

Analysis

max time kernel
136s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 19:17

Target

pcsx2-v1.5.0-dev-3390-g2c4af87e1-windows-x86/plugins/USBnull.dll
Size

19KB
MD5

d3ee37a66849bbd0810ceafbef27c00c
SHA1

029fcde2ff144a2d8f41ac04b747ba4185fea89f
SHA256

862f22804f4905f0d039af363068f3a2b8d2b64a411d5cb643a48f2072a810ba
SHA512

77f881a20426da665fbc8590f3209840f92f6d4dbd6a73003f1b72add57ad779d6751d214379dd95b7a3d1c8340f46580d6916ecebd8571f790d796b32cec933
SSDEEP

384:XAbniRF2KtZlXOohJcEzrj3nNrVriOH8zNFD:X8i+uZlXOohu+NrVriOczL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 4664	3152	rundll32.exe	92
PID 3152 wrote to memory of 4664	3152	rundll32.exe	92
PID 3152 wrote to memory of 4664	3152	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pcsx2-v1.5.0-dev-3390-g2c4af87e1-windows-x86\plugins\USBnull.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\pcsx2-v1.5.0-dev-3390-g2c4af87e1-windows-x86\plugins\USBnull.dll,#1
  2⤵
  PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4448