9a33666ae148a40cc5d1a93bbc5fc4badb2140f3466be7f82dda57173a986326

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 21:44

Target

9a33666ae148a40cc5d1a93bbc5fc4badb2140f3466be7f82dda57173a986326.dll
Size

6KB
MD5

e52adc30e25efe86b2c8806530bbd8ba
SHA1

af9d82645ec832d6a3a8d378a9cae04f9bde452f
SHA256

9a33666ae148a40cc5d1a93bbc5fc4badb2140f3466be7f82dda57173a986326
SHA512

e7af7822fc047f73fd7db88f10588c0ddf2e80a20c6da1dc252f481a723cf93041513ea14972d0770a117041a32cdd49abb06abb92d88196dd21e5b45a2ba836
SSDEEP

192:unSR6bgYijeLOJO7OaOp6h+kvWLO28ZcCK:uZ2eLqerfhw2ZcC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 4056	220	rundll32.exe	95
PID 220 wrote to memory of 4056	220	rundll32.exe	95
PID 220 wrote to memory of 4056	220	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a33666ae148a40cc5d1a93bbc5fc4badb2140f3466be7f82dda57173a986326.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a33666ae148a40cc5d1a93bbc5fc4badb2140f3466be7f82dda57173a986326.dll,#1
  2⤵
  PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4008 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:2960