30c69b5474d9bdf8d27a53aab9bfaf8ceb4b2e354f5e5e304b8983d6e9782242

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 01:19

Target

ad553158e75984fd3064922988239aef.dll
Size

182KB
MD5

ad553158e75984fd3064922988239aef
SHA1

fe4444853875cdcc4d7a20d6ae0f2bd43a34b22b
SHA256

30c69b5474d9bdf8d27a53aab9bfaf8ceb4b2e354f5e5e304b8983d6e9782242
SHA512

83cf0e9ac2f281ed5338c516ca6d40f39e2b6917fc23418c6b0322518f5187d6f9003e790bbce7b6db2305bd374a7aef24f43eeccb9c34683fc5b5ccdf72b6ed
SSDEEP

3072:hSboJsjLXwCKUDtfsQz/aoCx9RKYapx6gN3g+k5b1UdXYPYnEZdCBs2yNFByK2rP:Y97RD6QDaPQog1Lk5xUd+Y0dOKGP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2904	1720	rundll32.exe	94
PID 1720 wrote to memory of 2904	1720	rundll32.exe	94
PID 1720 wrote to memory of 2904	1720	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad553158e75984fd3064922988239aef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad553158e75984fd3064922988239aef.dll,#1
  2⤵
  PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:2836

memory/2904-0-0x0000000010000000-0x0000000010031000-memory.dmp

Filesize
196KB

Download
memory/2904-1-0x0000000010000000-0x0000000010031000-memory.dmp

Filesize
196KB

Download
memory/2904-2-0x0000000010000000-0x0000000010031000-memory.dmp

Filesize
196KB

Download
memory/2904-3-0x0000000000DB0000-0x0000000000DB5000-memory.dmp

Filesize
20KB

Download
memory/2904-4-0x0000000000D70000-0x0000000000D95000-memory.dmp

Filesize
148KB

Download
memory/2904-5-0x0000000010000000-0x0000000010031000-memory.dmp

Filesize
196KB

Download
memory/2904-6-0x0000000000D70000-0x0000000000D95000-memory.dmp

Filesize
148KB

Download
memory/2904-7-0x0000000000D70000-0x0000000000D95000-memory.dmp

Filesize
148KB

Download