a3924df964a4e90c60ab76c7627706dd4986c06c3c513b9dae66d2cb9dc80fe1

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 08:01

Target

lib/ExtendEdge.dll
Size

13KB
MD5

cb9472770470401df01b948054a8a17c
SHA1

d52913f655b0798649947296c144c2c3a97a56d7
SHA256

59b69b71a789bb38d89817ef235b1dfc67f546ffe87e0f732ae86f0538381953
SHA512

aae9c9a811ac04b5899103c0aaae1cab4e8dbde449341f329b1b72f82517ed9db2b38f16d4b536e1353898f531d787e9bb4d835964de4830a663114fda24f3a6
SSDEEP

192:lH9kibl5LYMm9OfPAjCkkb014FP3AzvlTAl8XiNtUR+PzRHtEiri5GAan:lH9kibldZm9OQerA14xQzvlcPtEMuGv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 2172	1168	rundll32.exe	80
PID 1168 wrote to memory of 2172	1168	rundll32.exe	80
PID 1168 wrote to memory of 2172	1168	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\ExtendEdge.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\ExtendEdge.dll,#1
  2⤵
  PID:2172