fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 01:22

Target

fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b.dll
Size

81KB
MD5

fbf6559769a9ae1165e0d37c6d14f54e
SHA1

7ba7508a0751522e30df5377c58cd61d24aa3d93
SHA256

fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b
SHA512

0fc1921fcd256c2c7461ede766f606f1b72092a563c67769fd63e03c41ba99ee6780ed2df9a86e1dbdf4f7f1069d3873b7496f281fb9f6dd3c47b8178a45cc19
SSDEEP

1536:cc+UPvS0RKCmqAvj45Hx8u05iecuYSoosWaocdBkez0U+GH:z+5oxmqAiR8+/RBkez0U+c

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 496 wrote to memory of 4936	496	rundll32.exe	91
PID 496 wrote to memory of 4936	496	rundll32.exe	91
PID 496 wrote to memory of 4936	496	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b.dll,#1
  2⤵
  PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:2864