5cc3e4cbba4046d3c5500122dd9ec6becc7813706e547a96ec1ad07265d65fdf

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 08:59

Target
ae22a3e1287eecdd84b0030d75a90ab1.dll
Size 22KB
Sample240229-kxzhsscd65
SHA256 5cc3e4cbba4046d3c5500122dd9ec6becc7813706e547a96ec1ad07265d65fdf
MD5 ae22a3e1287eecdd84b0030d75a90ab1
SHA1 17ce0d41a4785bfee8ed9bab59184234d244d615
SHA512 6b14850d117c079fedfaeb3e5bf27c23d85a4b0e734e7fb3bbdbc6b1fc5d0fb800d42b80ede476121437d25573caf0d753a951f272e67cc9d1eb1e234f96c50a
SSDEEP 384:TeH+tWzlSDrb5+gIS3a2Oaa2pbNGJ38pPJv1TCAxAr6+S9Pfu7n5u:dtWurb6SOaVwYxv1TlxndeVu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 2200	4576	rundll32.exe	95
PID 4576 wrote to memory of 2200	4576	rundll32.exe	95
PID 4576 wrote to memory of 2200	4576	rundll32.exe	95
PID 2200 wrote to memory of 2980	2200	rundll32.exe	99
PID 2200 wrote to memory of 2980	2200	rundll32.exe	99
PID 2200 wrote to memory of 2980	2200	rundll32.exe	99

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae22a3e1287eecdd84b0030d75a90ab1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae22a3e1287eecdd84b0030d75a90ab1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\Wscript.exe
    Wscript.exe c:\windows\ime\vbs\pp.vbs
    3⤵
    PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2524 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:2864

memory/2200-0-0x0000000010000000-0x000000001000D000-memory.dmp

Download