b8eb9d67513a1202a469b706ca34fcb509f17bbf51894e210fb5a073ba34c21c

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2024, 21:24

Target

dca564f509a3aa5a7f748f67607c6854.dll
Size

48KB
MD5

dca564f509a3aa5a7f748f67607c6854
SHA1

2392b9b77dc5716a3b5977b558b3edbbda99f715
SHA256

b8eb9d67513a1202a469b706ca34fcb509f17bbf51894e210fb5a073ba34c21c
SHA512

527ed0f875be78ee0cbd545d1e3c88a78a445a2bfe87bcc5026b4455256537c046505db8f9be4bb6b71b0b20069872d4b021ba01b9ba335064d02485bdf3a06a
SSDEEP

768:BR7dOahyoHokBtqN74W7bZZmYb9PyzcjRlYlwa6NVdkPnJJMIEV:8aAoHoc2x7bZoYBAcQlwJdMo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 4832	3348	rundll32.exe	94
PID 3348 wrote to memory of 4832	3348	rundll32.exe	94
PID 3348 wrote to memory of 4832	3348	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dca564f509a3aa5a7f748f67607c6854.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dca564f509a3aa5a7f748f67607c6854.dll,#1
  2⤵
  PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3792 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:1136