13055e34a28d8cd5d2d67bfb439a4a4cfa77dbdc1e72eb94aeae59b7b87981c4

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 03:20

Target

ccf93642085be74710f350cebb6755e9.dll
Size

192KB
MD5

ccf93642085be74710f350cebb6755e9
SHA1

5b3a95ba4bbcecbd017ee88eea63bc99847cfe14
SHA256

13055e34a28d8cd5d2d67bfb439a4a4cfa77dbdc1e72eb94aeae59b7b87981c4
SHA512

877520d2e0dd50ac1ad990c24801456d9fba7fcf9932e4c8558cd75c7d2d644654018013948deaf162149933cc17e53aee235d9671cdba9001846e04ee6e1112
SSDEEP

3072:1NbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/Hrm5e:1NbqaLD7RcukVAtSQOWcgWqbV77LmY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 456	1800	rundll32.exe	93
PID 1800 wrote to memory of 456	1800	rundll32.exe	93
PID 1800 wrote to memory of 456	1800	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccf93642085be74710f350cebb6755e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccf93642085be74710f350cebb6755e9.dll,#1
  2⤵
  PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:4848