b9bba8e0cebbeb9bae9a5be93e60d939fb41c3d26d9d999fe84f0233a8d2bcee

Analysis

max time kernel
157s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 00:10

Target

b9bba8e0cebbeb9bae9a5be93e60d939fb41c3d26d9d999fe84f0233a8d2bcee.dll
Size

342KB
MD5

f15d7081e573f6fd9892d12d87a1e3b2
SHA1

45323123ca2083c71ebab511fe2d361eca0e6b96
SHA256

b9bba8e0cebbeb9bae9a5be93e60d939fb41c3d26d9d999fe84f0233a8d2bcee
SHA512

0173e7f2ed0c0cd2a2ac7781a73bdb56602a6c62bc9afb9e61ef5ac65c99989767df546802b40a8e0a23c65e825d41d3a644ec5868d56d6385d7939e8655077f
SSDEEP

6144:IRoOpXN8bEvZehNyi5qlscXsKCkSLjn7WQDilmvWpJJvEiZ:IRoOpXCjNwlscXeJikilmvYEiZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 1688	4060	rundll32.exe	96
PID 4060 wrote to memory of 1688	4060	rundll32.exe	96
PID 4060 wrote to memory of 1688	4060	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9bba8e0cebbeb9bae9a5be93e60d939fb41c3d26d9d999fe84f0233a8d2bcee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9bba8e0cebbeb9bae9a5be93e60d939fb41c3d26d9d999fe84f0233a8d2bcee.dll,#1
  2⤵
  PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3780 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:3024