b7331595b9f9f71349ca8631d3ccfdb37cdbb13ebdcf2ea58c0d6e2a3d69e366

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 18:36

Target
c412335e1a733c79bafd3cc70bf6e030.dll
Size 37KB
Sample240312-w88fmaac76
SHA256 b7331595b9f9f71349ca8631d3ccfdb37cdbb13ebdcf2ea58c0d6e2a3d69e366
MD5 c412335e1a733c79bafd3cc70bf6e030
SHA1 3b677b6ff06ac3851eb2762e614bd700331f02c5
SHA512 43a07e34064b11db2478f6688e380c4c3904a38349ec10cdc53d3b6aa91a51549ea4a0a68b29e3bc8328e0429874cdb97865e7d6608e4833a88a1bb3203a1295
SSDEEP 768:IykqSQ17lTIcoj6nNzdGdvzvHllN+zgtm6xa/UPZ0aaMxQ:/kqSQTdoazQBf/NpUZDMC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2660	2468	rundll32.exe	93
PID 2468 wrote to memory of 2660	2468	rundll32.exe	93
PID 2468 wrote to memory of 2660	2468	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c412335e1a733c79bafd3cc70bf6e030.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c412335e1a733c79bafd3cc70bf6e030.dll,#1
  2⤵
  PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:8
1⤵
PID:2148