8af3d8f412477d72f6206c9febf4cc04fb8d8196d89a0c3d39bb8bdc2b84f47f

Analysis

max time kernel
114s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 22:46

Target

8af3d8f412477d72f6206c9febf4cc04fb8d8196d89a0c3d39bb8bdc2b84f47f.dll
Size

6KB
MD5

e22f7651719b3d69ec7e8af682646a2d
SHA1

8fe74dff2a51f4baa9973114e4de06c8a75d247b
SHA256

8af3d8f412477d72f6206c9febf4cc04fb8d8196d89a0c3d39bb8bdc2b84f47f
SHA512

5706e0b00b2cb0d7b94edd5ee87f2d6aefdac350e1f30a56640709a9b25b8ddc86f11423b7065bfc55918805724de22f5927c6d89680b31d5868e82a2d57b249
SSDEEP

48:6DOdd5YVOiFVE/y/sqwokyJyi0nB+BDq9J5S9:piFVE/y6okJjB+FqX5S9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 4288	3020	rundll32.exe	91
PID 3020 wrote to memory of 4288	3020	rundll32.exe	91
PID 3020 wrote to memory of 4288	3020	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8af3d8f412477d72f6206c9febf4cc04fb8d8196d89a0c3d39bb8bdc2b84f47f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8af3d8f412477d72f6206c9febf4cc04fb8d8196d89a0c3d39bb8bdc2b84f47f.dll,#1
  2⤵
  PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2256,i,9172343514068348080,519219714517961765,262144 --variations-seed-version /prefetch:8
1⤵
PID:3828