ba9cdc1c011d719ef70a8744fc71f4cb335c868866bbe608bbe076155db56aab

Analysis

max time kernel
153s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 11:17

Target

c074fe0a4605edc46712c1521bec103b.dll
Size

8KB
MD5

c074fe0a4605edc46712c1521bec103b
SHA1

4b5b2d783db9a1530399d572e89e147076adc78e
SHA256

ba9cdc1c011d719ef70a8744fc71f4cb335c868866bbe608bbe076155db56aab
SHA512

866a2ef0957e2af5123bce1b1f9e28e1a82deb7c5c7e7e2a5d54c1f6553487ce907e683dfb69c76e6f9e984db98ecd1d96e84502e32891041d2c6d8c6ccd8ce9
SSDEEP

96:SWSHW+Iz4NYJDm/NEoBGcqbWx+D2P4JhM14HL8yGshC+8omxK65slZZx:SF3Y5mjUbQ7P4c14rvhCgmkqslZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 4436	1052	rundll32.exe	94
PID 1052 wrote to memory of 4436	1052	rundll32.exe	94
PID 1052 wrote to memory of 4436	1052	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c074fe0a4605edc46712c1521bec103b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c074fe0a4605edc46712c1521bec103b.dll,#1
  2⤵
  PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:5012