5e733d6c78e3454bbb770f8c00a3a143a0a02739e86fc39a6adf18f8b914f1fe

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 21:15

Target

5e733d6c78e3454bbb770f8c00a3a143a0a02739e86fc39a6adf18f8b914f1fe.dll
Size

7KB
MD5

e13e3ea6c51d094e2b7020866fef6bbc
SHA1

12f14fe7bdac19b1eec2a0ae1b06c86106beb3a0
SHA256

5e733d6c78e3454bbb770f8c00a3a143a0a02739e86fc39a6adf18f8b914f1fe
SHA512

c69e341e76565f9dd06ffad7bbec196813af25322ff229423a868a53a536964d8648766414e8b203e737aa67811f737323d64f597c1c2033665ef4e2a2b99a52
SSDEEP

96:wb4VHccYJUC/aFbz/j0OvaPmd3cX5aXW:wUaJf/aFbP0O12JaX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1220	3012	rundll32.exe	92
PID 3012 wrote to memory of 1220	3012	rundll32.exe	92
PID 3012 wrote to memory of 1220	3012	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e733d6c78e3454bbb770f8c00a3a143a0a02739e86fc39a6adf18f8b914f1fe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e733d6c78e3454bbb770f8c00a3a143a0a02739e86fc39a6adf18f8b914f1fe.dll,#1
  2⤵
  PID:1220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3724 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:4884