748c5480892a0888eb59e5511d6fe18e0f3aa0fe297539e3429c615d91b78fe6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 11:54

Target

cdff63b55714e9de3dadedba14c52c4a.dll
Size

80KB
MD5

cdff63b55714e9de3dadedba14c52c4a
SHA1

91b1fa7a75ea131792574250aae003c96ffeca16
SHA256

748c5480892a0888eb59e5511d6fe18e0f3aa0fe297539e3429c615d91b78fe6
SHA512

bd5be76a39d34b8693b253257c9eafd2c0ffba4dc8ba9b32f5e6bf178d3b4e75246ff8ed689976869e7e1402cd777e363d5c24ff11a3c885f23f453f1c5e9d60
SSDEEP

1536:3hgHvw2cBaHTVpPG5aQtvWwCbneb9yxr4nGYkH4/F8qX:xgPn6aHW5aazPyKn0H4d8q

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4432	4780	rundll32.exe	93
PID 4780 wrote to memory of 4432	4780	rundll32.exe	93
PID 4780 wrote to memory of 4432	4780	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdff63b55714e9de3dadedba14c52c4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdff63b55714e9de3dadedba14c52c4a.dll,#1
  2⤵
  PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:4104

memory/4432-0-0x0000000065190000-0x00000000651A8000-memory.dmp

Filesize
96KB

Download