092a2d44643b1f5e1b4d2462a7a467994dbe7ea914cc050a393f9ebd30c51469

Analysis

max time kernel
141s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 18:21

Target

092a2d44643b1f5e1b4d2462a7a467994dbe7ea914cc050a393f9ebd30c51469.dll
Size

6KB
MD5

902b348f01ac21ece70ca33043f4244c
SHA1

9730191ca661d2d362af13479ea232600a6c6a8d
SHA256

092a2d44643b1f5e1b4d2462a7a467994dbe7ea914cc050a393f9ebd30c51469
SHA512

25f5fcb2a8c38091bdcb35f9b9989f4a98198456ba71b1efa373470dea6fae9f3538e2ec6df5fe17cd025b44e8fd1e343eb033b9f29258e16d5fe6ef954382c3
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0LB+BDq9J5SH:VDa9VUX9bQWrB+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 3392	464	rundll32.exe	95
PID 464 wrote to memory of 3392	464	rundll32.exe	95
PID 464 wrote to memory of 3392	464	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\092a2d44643b1f5e1b4d2462a7a467994dbe7ea914cc050a393f9ebd30c51469.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\092a2d44643b1f5e1b4d2462a7a467994dbe7ea914cc050a393f9ebd30c51469.dll,#1
  2⤵
  PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3220