e12c70f93b0fbf470477f2f76bfd4a4d0dcd00df8492a457653d7504e4a70b63

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 17:07

Target

c927e707357a48e9ef7abaa7101d9ecc.dll
Size

179KB
MD5

c927e707357a48e9ef7abaa7101d9ecc
SHA1

41f2c1c2ad2732fbdde9116c0b31286992a52520
SHA256

e12c70f93b0fbf470477f2f76bfd4a4d0dcd00df8492a457653d7504e4a70b63
SHA512

383ddeeb8b08e2338fd45cd69e725527db79e5f90d3c34879e858e2147382634336c1fab2b32c4261454fbf727ebc932dca8d6a93fd88ec2c8df1f29cb8d8542
SSDEEP

3072:EPQ+CQ2bpfKg1zA/WfeOGAbrzHJlp4Yph24d2kbySiVTSBGafogriC9BDMqqDLyd:EY+CQ2bpfl1M/WfeOGAbrzHJlp4Yph2I

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 4140	3808	rundll32.exe	93
PID 3808 wrote to memory of 4140	3808	rundll32.exe	93
PID 3808 wrote to memory of 4140	3808	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c927e707357a48e9ef7abaa7101d9ecc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c927e707357a48e9ef7abaa7101d9ecc.dll,#1
  2⤵
  PID:4140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:3568

memory/4140-0-0x0000000000720000-0x000000000072A000-memory.dmp

Filesize
40KB

Download
memory/4140-3-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download