66d62f7fc2538a7162cbab7a7ac433b30f70d18d02daee1b9e30b3fb230d8335

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 21:33

Target

66d62f7fc2538a7162cbab7a7ac433b30f70d18d02daee1b9e30b3fb230d8335.dll
Size

6KB
MD5

8d64f20b80e99b3e32549b0ddc3f3f1b
SHA1

686965b52161a253cd3b9a7a4d2b7ea300db81bf
SHA256

66d62f7fc2538a7162cbab7a7ac433b30f70d18d02daee1b9e30b3fb230d8335
SHA512

d0ae3703c1138cad6bdc45456199ddae80bc3c2b98d477ca2e04a1171667366dda28d02d09fe01953e51bcdba8d1485eecba57a13de70cb419b63fb27a9fc299
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU10kB+BDq9J5SV3DY:CSVVEPozmB76B+FqX5S1D

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 4660	1932	rundll32.exe	92
PID 1932 wrote to memory of 4660	1932	rundll32.exe	92
PID 1932 wrote to memory of 4660	1932	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66d62f7fc2538a7162cbab7a7ac433b30f70d18d02daee1b9e30b3fb230d8335.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66d62f7fc2538a7162cbab7a7ac433b30f70d18d02daee1b9e30b3fb230d8335.dll,#1
  2⤵
  PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:5000