b0357d0d52a85c405f2c96ff75a5a94443ae8eba177a61dc8e4ef80447deac74

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 01:05

Target

b0357d0d52a85c405f2c96ff75a5a94443ae8eba177a61dc8e4ef80447deac74.dll
Size

81KB
MD5

76b96529ebb6ebb701a70616d424308f
SHA1

37c84a14a2b7f18af8402adfa28adb9ece89aa1c
SHA256

b0357d0d52a85c405f2c96ff75a5a94443ae8eba177a61dc8e4ef80447deac74
SHA512

fdca51729ade329718ece10da189f6af992d14b7222b65ce8ecb3daa9e1bfccddee5064ad16bffb271028cd1c82e347b288f7bff1f1be5cf90c41d70ce3ee831
SSDEEP

1536:vc+UPvS0RKCmqAvj45Hx8u05iecuYSoosWaocdBkez0U+GO:k+5oxmqAiR8+/RBkez0U+Z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2660	812	rundll32.exe	94
PID 812 wrote to memory of 2660	812	rundll32.exe	94
PID 812 wrote to memory of 2660	812	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0357d0d52a85c405f2c96ff75a5a94443ae8eba177a61dc8e4ef80447deac74.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0357d0d52a85c405f2c96ff75a5a94443ae8eba177a61dc8e4ef80447deac74.dll,#1
  2⤵
  PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:8
1⤵
PID:3568