3a6532859d2c2e09dca134f6cc30e28f0ecff7355d38e4e1cff00824e10bc33d

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 16:28

Target

a99e367a79415649b274c8c19c1262f5.dll
Size

13KB
MD5

a99e367a79415649b274c8c19c1262f5
SHA1

f5da64d49579cee38cdc8f7c0a2fea919b449362
SHA256

3a6532859d2c2e09dca134f6cc30e28f0ecff7355d38e4e1cff00824e10bc33d
SHA512

d0d18c292eee7ed845c2b14738edb7e122a528325308aaa275e789431424ce168da41ed5f1ad0ad681cda6c91289292211c0d65e91543724a0428f9e96851b5e
SSDEEP

192:nnS2Sr4f9W3l0vdV+fM0xbjlYXNMplDN1egkHeU4pOji7+bV/kOrU/lBoFSocNXu:S2Sh2vDSl9TDW57qOG7FKWBo8XqL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 672	3256	rundll32.exe	91
PID 3256 wrote to memory of 672	3256	rundll32.exe	91
PID 3256 wrote to memory of 672	3256	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a99e367a79415649b274c8c19c1262f5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a99e367a79415649b274c8c19c1262f5.dll,#1
  2⤵
  PID:672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:4628

memory/672-0-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/672-1-0x0000000001320000-0x0000000001321000-memory.dmp

Filesize
4KB

Download
memory/672-2-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/672-3-0x0000000001320000-0x0000000001321000-memory.dmp

Filesize
4KB

Download