61913e0a38282a42b26aff578da17dab60ac0fbee819fa42db5497cc5cf55760

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 07:58

Target

61913e0a38282a42b26aff578da17dab60ac0fbee819fa42db5497cc5cf55760.dll
Size

284KB
MD5

8b3f6ffcbe0a7c4f7656729f110d0f22
SHA1

dd21bf57ce8473c53420e4d794fc8d5efc2a78f3
SHA256

61913e0a38282a42b26aff578da17dab60ac0fbee819fa42db5497cc5cf55760
SHA512

6a2d5e2c969b96e234ee276c4e6e5c0df56db9f00346ee77beec2ddcde81269ce729399900ece28fc3ed466f1245d718ec90f645070dc715b680547b0371938b
SSDEEP

6144:WZgBecZz+WaCfPx8KF0zPEqTY3bxpyJWI:WZARPuKF0DEqKbxpyJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 3080	2564	rundll32.exe	96
PID 2564 wrote to memory of 3080	2564	rundll32.exe	96
PID 2564 wrote to memory of 3080	2564	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61913e0a38282a42b26aff578da17dab60ac0fbee819fa42db5497cc5cf55760.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61913e0a38282a42b26aff578da17dab60ac0fbee819fa42db5497cc5cf55760.dll,#1
  2⤵
  PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:3628