b9edc02be49e953a61cba7d7dde45cb19ac4b8975ec79f329808ba0d751ba4cb

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 00:24

Target

b9edc02be49e953a61cba7d7dde45cb19ac4b8975ec79f329808ba0d751ba4cb.dll
Size

6KB
MD5

912a3e1c1cb9a96ed2da097895c8dc04
SHA1

6d81a930402101e219edacb3d7a579114e763d3c
SHA256

b9edc02be49e953a61cba7d7dde45cb19ac4b8975ec79f329808ba0d751ba4cb
SHA512

fd1a5ba4840311590724cf0c70b798d960e911fe2f724153e42e52eb3bd1e234f9143daf588e9620af320b539fda8945df5d268bab9bfef4c5f8bfecda3203c8
SSDEEP

48:6DOdd5YVOiFVE/y/sqwokyJyi0+B+BDq9J5S9:piFVE/y6okJqB+FqX5S9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 2504	4260	rundll32.exe	93
PID 4260 wrote to memory of 2504	4260	rundll32.exe	93
PID 4260 wrote to memory of 2504	4260	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9edc02be49e953a61cba7d7dde45cb19ac4b8975ec79f329808ba0d751ba4cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9edc02be49e953a61cba7d7dde45cb19ac4b8975ec79f329808ba0d751ba4cb.dll,#1
  2⤵
  PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:2800