57e90295056333b0de05689523eef17285d034a25a9a1965d789da54af854aee

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:17

Target
$APPDATA/Vuze Turbo Booster/packet.dll
Size 60KB
Sample240614-algtha1cpm
SHA256 0b681d867089f44fd9c25a343b94b229b3d9db65d060c6c3767535a31e3eeee4
MD5 c123eb3439ae8ab13a971bb6f0515411
SHA1 3ffa02b544b90433e816136e3bbffad0ca19735c
SHA512 99f91d83d43dd73b6737dbbbf4eebf045d9e6a3f2a690210c67f363fa734d1a60b8b306798950668f80762798f52c7c2cfb65260766bbc5aced65ef306fb7aa7
SSDEEP 768:ZPwRf6Bph61db4Ws71Ti/kZSC2pZplWsv9Q/OpKX:wZGr71TiYSCa4ilKX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 2748	4712	rundll32.exe	89
PID 4712 wrote to memory of 2748	4712	rundll32.exe	89
PID 4712 wrote to memory of 2748	4712	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\Vuze Turbo Booster\packet.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\Vuze Turbo Booster\packet.dll",#1
  2⤵
  PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3976,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
1⤵
PID:1280