9a1e75586a5ffc64b2707cdc2fc7e272871b249575ee949fc564b007ee154d7b

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 23:50

Target

9a1e75586a5ffc64b2707cdc2fc7e272871b249575ee949fc564b007ee154d7b.dll
Size

6KB
MD5

1008988ae9fd1a3f86b57f8f77c36bda
SHA1

1b30a7983877991f9e1adbb8d37c8ea07012dc61
SHA256

9a1e75586a5ffc64b2707cdc2fc7e272871b249575ee949fc564b007ee154d7b
SHA512

820f14b882113fccb5746e866c503498a387c616feb90346bcb95ab1d1c5e94a36eea7f6b9784fa7c830d70a74639317b9f2c0b8148f9742188e32f3c95462a3
SSDEEP

96:nEY2RrF1eqwi4ti9uXhCm5xro8VEaui0RrtrIQX0lZW4AK:EHRh1eppXXf5dBxa/0C4A

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 5088	4340	rundll32.exe	94
PID 4340 wrote to memory of 5088	4340	rundll32.exe	94
PID 4340 wrote to memory of 5088	4340	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a1e75586a5ffc64b2707cdc2fc7e272871b249575ee949fc564b007ee154d7b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a1e75586a5ffc64b2707cdc2fc7e272871b249575ee949fc564b007ee154d7b.dll,#1
  2⤵
  PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2228,i,17475224967547320003,13667387715861799238,262144 --variations-seed-version /prefetch:8
1⤵
PID:4536