b2392fae18ffa481b2e1a7f0a6bcf87405859c1406417390858bd0b938fd49cc

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 23:02

Target

949343512e2d6e3b29ba644d186192bc.dll
Size

7KB
MD5

949343512e2d6e3b29ba644d186192bc
SHA1

ca7385a43d9548cdd0b4f2cf8680b583f7b78a1a
SHA256

b2392fae18ffa481b2e1a7f0a6bcf87405859c1406417390858bd0b938fd49cc
SHA512

a6eeb141f87a8f8a632f5d1130d6ff505ab92e4ae30df17e5a252bb8cc47e4a0568271a8a21bda11dd6981959c8d8a54665786bcb2fe1ddcb0b67e1aa94b9b72
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW7bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPlq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 4824	3844	rundll32.exe	90
PID 3844 wrote to memory of 4824	3844	rundll32.exe	90
PID 3844 wrote to memory of 4824	3844	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\949343512e2d6e3b29ba644d186192bc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\949343512e2d6e3b29ba644d186192bc.dll,#1
  2⤵
  PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2536,i,8161505972217706694,705854963991409854,262144 --variations-seed-version /prefetch:8
1⤵
PID:1508