4bc4a38858bb8a79b53950e8e9a9a28d00e31b901738af1bd325ceb5f12f0a27

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 20:14

Target

4bc4a38858bb8a79b53950e8e9a9a28d00e31b901738af1bd325ceb5f12f0a27.dll
Size

342KB
MD5

108fd1ec31d7bfca8b1998d0fbec2c76
SHA1

6812a72cf30a2776c54ddde99681211c176e1dc7
SHA256

4bc4a38858bb8a79b53950e8e9a9a28d00e31b901738af1bd325ceb5f12f0a27
SHA512

a40763800d3854e07c4aa97184827a16dacb77b8a7a6b84cf5d6277dabcdcce433a195e15055b6bf1d04d6e3a293ffe82e65f2884aa29a4d7ab950b369783433
SSDEEP

6144:TRoOpXN8bEvZehNyi5qlscXsKCkSLjn7WQDilmvWpJJvEiR:TRoOpXCjNwlscXeJikilmvYEiR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 3660	116	rundll32.exe	95
PID 116 wrote to memory of 3660	116	rundll32.exe	95
PID 116 wrote to memory of 3660	116	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bc4a38858bb8a79b53950e8e9a9a28d00e31b901738af1bd325ceb5f12f0a27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bc4a38858bb8a79b53950e8e9a9a28d00e31b901738af1bd325ceb5f12f0a27.dll,#1
  2⤵
  PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:1904