229cbbac4a8000069d5ea52b0a864345b2e0a624f152f7f0472b942d2f269e29

Analysis

max time kernel
135s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2024 20:26

Target

PvZ_Tools_v2.7.5/Qt5Gui.dll
Size

3.2MB
MD5

b34d41973ce7754a2d5225570f8fbb8b
SHA1

2b23fafe1c5447d3e16156f4f9b22f50ee8c00ac
SHA256

6eb057e70d2148f37aa89976b627bca2c7c9cb32006d67f86607aa7355cf0484
SHA512

0bdde48c34f028d26d9bd549ab638184b151d3d5246249209dd4c372b00d0353aff2730108677da9867176d2c58668cbbb8cbf5453da1251052855219fb69263
SSDEEP

49152:7l/v38OKdWsSqIddyuIXKA4UmBfmuxg4SE7eezSuqh086tNNK2GQ6:R/v38OKdWsSl/yuiWf564zeezSuqh/Q

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 1956	332	rundll32.exe	92
PID 332 wrote to memory of 1956	332	rundll32.exe	92
PID 332 wrote to memory of 1956	332	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZ_Tools_v2.7.5\Qt5Gui.dll,#1
  2⤵
  PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4900