21e795e3e6a1ad6ac4b4c300b72f232b7e7f6beaa075e39b2a6ecbd67833e5f1

Analysis

max time kernel
137s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 18:15

Target

21e795e3e6a1ad6ac4b4c300b72f232b7e7f6beaa075e39b2a6ecbd67833e5f1.dll
Size

25KB
MD5

aaf2b22939730cfc147dc188c82acdff
SHA1

3b2c32441363b4aba608487b766a0c9c69e60254
SHA256

21e795e3e6a1ad6ac4b4c300b72f232b7e7f6beaa075e39b2a6ecbd67833e5f1
SHA512

6a56bd48fe66a24eefa6653a0581e25481d27f93188f5333fde0e3c757ef8772149aa4a42aca6867e1e4b89c3b60e91f8bdea52dbbd592557bd38ff867cc2a07
SSDEEP

384:UUFNNNqJMlMEDqzaoBfn8+n+8IeyGKCKEmVr9Cy8JN77hhQb:JNNwuiHaou++8IjVrcd3hmb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1968	2352	rundll32.exe	96
PID 2352 wrote to memory of 1968	2352	rundll32.exe	96
PID 2352 wrote to memory of 1968	2352	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21e795e3e6a1ad6ac4b4c300b72f232b7e7f6beaa075e39b2a6ecbd67833e5f1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21e795e3e6a1ad6ac4b4c300b72f232b7e7f6beaa075e39b2a6ecbd67833e5f1.dll,#1
  2⤵
  PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:928