4018a1b6d2544d9f68f16339f08b0206bb2d7703a63aac935ea6cd1c3a507a40

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 23:43

Target

c1e8a872b2f7f293c10c0d9fa860d33e.dll
Size

28KB
MD5

c1e8a872b2f7f293c10c0d9fa860d33e
SHA1

454dd38baf04bf551a0749b92f27b26776c07543
SHA256

4018a1b6d2544d9f68f16339f08b0206bb2d7703a63aac935ea6cd1c3a507a40
SHA512

5fad4c2b0c5aa88cc085e79aba1771fbe6381bf661fd5f36f34766e33699481d5f1e4e862fd37108ae3a876e6a0623fd3c226f09295df1b228f27daf0903ab8e
SSDEEP

384:fCEvvCnwcS60olydY4PEkZyYGZa2ArLhnXMspct5mAjcDmCO:pvCnw760JPckZyLZlAPhnXZat5mLDTO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4588	4752	rundll32.exe	94
PID 4752 wrote to memory of 4588	4752	rundll32.exe	94
PID 4752 wrote to memory of 4588	4752	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1e8a872b2f7f293c10c0d9fa860d33e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1e8a872b2f7f293c10c0d9fa860d33e.dll,#1
  2⤵
  PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2256,i,18272763564106695635,11201593968620719822,262144 --variations-seed-version /prefetch:8
1⤵
PID:4944