6d0a7a33783c068e47409152c53bd748c30e199e68da505affa1d69db0e472c8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 21:45

Target

6d0a7a33783c068e47409152c53bd748c30e199e68da505affa1d69db0e472c8.dll
Size

6KB
MD5

b934968a7032d1da6739ede2f1fa8ad9
SHA1

8356acca39aaa8c1f6256a2d83f1e254cd8fd45c
SHA256

6d0a7a33783c068e47409152c53bd748c30e199e68da505affa1d69db0e472c8
SHA512

1a99e71a970ce2dd628bbbfb4a0e6fabe415301888e241696759108e4a5cb7c325e884d9bcd405475c3c9a51503450b82178e07dccfbac490a6e218fa3bd733b
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G0KB+BDq9J5S2:0QDV8FscMjsLFV3iB+FqX5S2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4656	5008	rundll32.exe	92
PID 5008 wrote to memory of 4656	5008	rundll32.exe	92
PID 5008 wrote to memory of 4656	5008	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d0a7a33783c068e47409152c53bd748c30e199e68da505affa1d69db0e472c8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d0a7a33783c068e47409152c53bd748c30e199e68da505affa1d69db0e472c8.dll,#1
  2⤵
  PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:4936