37dc8ef230d58cbd3f285e2faba7afc5480bd094e3649712e8179f04b4f1b782

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 19:54

Target

37dc8ef230d58cbd3f285e2faba7afc5480bd094e3649712e8179f04b4f1b782.dll
Size

6KB
MD5

b3b9be4a427fffacd67e9b6644170a92
SHA1

168a3518649e0e4001a41d140fda406c6d4f4dd9
SHA256

37dc8ef230d58cbd3f285e2faba7afc5480bd094e3649712e8179f04b4f1b782
SHA512

dfc4eecde9b23f18c0df656a140d48a6d467144cdd6da415c8ede638b10c768a8b93424bf21dc704670e008d2e6e287b205e14665b1b9c2ea08156c0a415e58a
SSDEEP

48:63mll5YVOa9VUX1iwbQWu09B+BDq9J5SH:VDa9VUX9bQWdB+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 4916	1464	rundll32.exe	91
PID 1464 wrote to memory of 4916	1464	rundll32.exe	91
PID 1464 wrote to memory of 4916	1464	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37dc8ef230d58cbd3f285e2faba7afc5480bd094e3649712e8179f04b4f1b782.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37dc8ef230d58cbd3f285e2faba7afc5480bd094e3649712e8179f04b4f1b782.dll,#1
  2⤵
  PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2264,i,7010714054498059916,1862725710331979271,262144 --variations-seed-version /prefetch:8
1⤵
PID:712