9355ea53cbcd441120d378c345703830ac86038ba8352787adf027896a800417

Analysis

max time kernel
137s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 23:02

Target

9355ea53cbcd441120d378c345703830ac86038ba8352787adf027896a800417.dll
Size

7KB
MD5

20c9d499230d3672244c528d8d01e25a
SHA1

64084e2434f32d34a700c0d1f9118f560c7da161
SHA256

9355ea53cbcd441120d378c345703830ac86038ba8352787adf027896a800417
SHA512

75d0779537f9121f069fb3d8f7fc62fb9ec8060b3a860b4e2f0c697992ea8c83c93301e80158d7912dc7dd9f670ca060a21a5b2524616b1de5c4cac60eca071f
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWrCbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPc5q3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 5076	32	rundll32.exe	93
PID 32 wrote to memory of 5076	32	rundll32.exe	93
PID 32 wrote to memory of 5076	32	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9355ea53cbcd441120d378c345703830ac86038ba8352787adf027896a800417.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:32
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9355ea53cbcd441120d378c345703830ac86038ba8352787adf027896a800417.dll,#1
  2⤵
  PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3948 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:3152