53563fbd91f64957c81e813d206a6afc7224cc8d391e5b982231afe0aa49b79c

Analysis

max time kernel
124s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:11

Target
Ancer-v3.5/Ancer/SkinMagic.dll
Size 308KB
Sample240613-bj59raydlc
SHA256 679028f84556b19c6b4b6810996a32f8e06964b164f07fc29b1761b6315b6c47
MD5 f7989c079942936fb74ab30f59cf80c1
SHA1 4179c447738471efc0d71b606c6451b3cdb93f43
SHA512 6b8bf3f0432009ca5e64f2d1ded81ebaba71f25d0ab63203ccc56e3267b28d1d00cb24f4786ead7178eacb1d8a14819d53af6fed7f8ef7c64754883fa841fc5f
SSDEEP 6144:3Yzh6ltijPftZWkBfioMFFDHPLc/zzm6Z:o04XjBq3JHGZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 1012	2284	rundll32.exe	91
PID 2284 wrote to memory of 1012	2284	rundll32.exe	91
PID 2284 wrote to memory of 1012	2284	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ancer-v3.5\Ancer\SkinMagic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ancer-v3.5\Ancer\SkinMagic.dll,#1
  2⤵
  PID:1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4252,i,11049150160560877369,2866371920339304689,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:8
1⤵
PID:4804