6229742fa5197be6a807eefcdaebb9cbaa635043e8a5b82fa9c4fc8bdec0df58

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 21:09

Target

6229742fa5197be6a807eefcdaebb9cbaa635043e8a5b82fa9c4fc8bdec0df58.dll
Size

5KB
MD5

16ec64b32d98400758b4ebe8fde2425a
SHA1

2340c41a6252ef86ee85856cee92e1614307625d
SHA256

6229742fa5197be6a807eefcdaebb9cbaa635043e8a5b82fa9c4fc8bdec0df58
SHA512

3ddcd5c57fb0bcccac3b829880f4d3fa6cdf4fdd2bbe12e6bd0f0f512c764613b7b703ed138a5ab44aef27df186ad2e086d35633065f4051d158ca17609a7f16
SSDEEP

96:hy859x0P8MakPm+8lMmhz4sloQydvss76:F5oLru+fmhzF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 2616	1016	rundll32.exe	96
PID 1016 wrote to memory of 2616	1016	rundll32.exe	96
PID 1016 wrote to memory of 2616	1016	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6229742fa5197be6a807eefcdaebb9cbaa635043e8a5b82fa9c4fc8bdec0df58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6229742fa5197be6a807eefcdaebb9cbaa635043e8a5b82fa9c4fc8bdec0df58.dll,#1
  2⤵
  PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:1820