4e32b808c7213705557845a4699b50f0a89ab22abcc48866e888ab0c82da01d1

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 10:44

Target
abb0b659e6ae1664fbcecc8484eb1d10.dll
Size 428KB
Sample240228-ms8a9ahf82
SHA256 4e32b808c7213705557845a4699b50f0a89ab22abcc48866e888ab0c82da01d1
MD5 abb0b659e6ae1664fbcecc8484eb1d10
SHA1 ea75106b1df5be33647041e1ae755d78f3f861dc
SHA512 ab204c99af28303c1042b9c2f47c4bb63270c5d22d86dc96dd6732c32acdacb998cc3457d6a425760d6fd75338bf24b63b50309a1b1314976cef7bfe99883bcc
SSDEEP 6144:FwDOuMmzJsGwA5/6XYfJfhI966AGkAjOpoaY7rdqfpAiEIXaHW/axuDXFsCK9xFK:FmDFzOExkYf7q6xGJOpqC7HqHpx4yVM
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 404	2060	rundll32.exe	93
PID 2060 wrote to memory of 404	2060	rundll32.exe	93
PID 2060 wrote to memory of 404	2060	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\abb0b659e6ae1664fbcecc8484eb1d10.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\abb0b659e6ae1664fbcecc8484eb1d10.dll,#1
  2⤵
  PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:4740

memory/404-0-0x0000000010000000-0x00000000100A0000-memory.dmp

Download