c75a864489da2b16ee3b6b7fb6d6c90ce3d668f53c6e89ade94b7253f0140f0b

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 14:26

Target

ac1a756cb4c031c704d17f497c116598.dll
Size

88KB
MD5

ac1a756cb4c031c704d17f497c116598
SHA1

8590ff7c484e3cbb07dc36bae59fc8188ab0751e
SHA256

c75a864489da2b16ee3b6b7fb6d6c90ce3d668f53c6e89ade94b7253f0140f0b
SHA512

50d64ff911a86f61c1218f4ad2560e988501881df15a2d85e8eac6c62d875fa49102e21701133d3c542d2631e8f792cb4844e318d516818791a5ba7042799e9d
SSDEEP

1536:v+I5Stw6oYKrQmL74Ri0X7WjtpyBR1uABuCE7ToBwfRdvX/g/:vB5cZoYKrl4RieyZsBHuABIoBwrnC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 2816	4024	rundll32.exe	27
PID 4024 wrote to memory of 2816	4024	rundll32.exe	27
PID 4024 wrote to memory of 2816	4024	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1a756cb4c031c704d17f497c116598.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac1a756cb4c031c704d17f497c116598.dll,#1
  2⤵
  PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:8
1⤵
PID:4764

memory/2816-0-0x0000000000AA0000-0x0000000000AAA000-memory.dmp

Filesize
40KB

Download
memory/2816-2-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/2816-4-0x0000000000AA0000-0x0000000000AAA000-memory.dmp

Filesize
40KB

Download
memory/2816-8-0x0000000000AA0000-0x0000000000AAA000-memory.dmp

Filesize
40KB

Download