d618b457c1310790385c4efeb88e8afaa61876e42b17bc329bb148694a4b5a00

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 15:09

Target

$TEMP/trailer/SoapSudsCode.dll
Size

12KB
MD5

5edcc6ee883be2350317116a22002d3a
SHA1

fe69e48b4b67fb4c02b987387e8e567492b4d992
SHA256

6b7d09c8698c90846dbd325fe7ae35d4ac48ce86e0d7dd4455481b532400de52
SHA512

8f558161f54dad0b7a9868d8493bf2860c7e7c03a524adee240b3a1a2d01caab7f09da186735ea3b7e0ca8515a298a8634b9c2d16ade3d21ca6835c984536fb6
SSDEEP

192:VUN8oYhY/IlEKXf6ExZ2Yn44IpPUKJJk746NpdxCA4Fkj7lWhvNnZW/:VuhiEKXf6yZ2oEJs4WUFOlWhlnZW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2548 wrote to memory of 2356	2548	rundll32.exe	rundll32.exe
PID 2548 wrote to memory of 2356	2548	rundll32.exe	rundll32.exe
PID 2548 wrote to memory of 2356	2548	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\trailer\SoapSudsCode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\trailer\SoapSudsCode.dll,#1
2⤵
PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:3416