d3ee0561dba7d6b602c624652441a6e3315f7f71e9d6fe3f3177e9e1a9df6b16

Analysis

max time kernel
158s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 23:29

Target

d3ee0561dba7d6b602c624652441a6e3315f7f71e9d6fe3f3177e9e1a9df6b16.dll
Size

97KB
MD5

f170e9de2160f7ee320ba9b13c2fc3a8
SHA1

4384377a5d4fe208874a92f34b14328910fa9cab
SHA256

d3ee0561dba7d6b602c624652441a6e3315f7f71e9d6fe3f3177e9e1a9df6b16
SHA512

6dd09c7350acb99d46fa660811451b40cf65be94a788354e93ba709ed610d404d437e47454b5d1311e3e6b8fc4adff53abeb736033c53fb2c02c6be014f6708b
SSDEEP

3072:9Du9SiDLv7obAgwG4oSvwQBVQFMSkx9D4bZ9KIJylsrCxotcTdx1PXQK6aJGTfPS:USiDb73jPoSvwQBVQFMSkx9D4bZ9KIJ4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 4048	780	rundll32.exe	92
PID 780 wrote to memory of 4048	780	rundll32.exe	92
PID 780 wrote to memory of 4048	780	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3ee0561dba7d6b602c624652441a6e3315f7f71e9d6fe3f3177e9e1a9df6b16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3ee0561dba7d6b602c624652441a6e3315f7f71e9d6fe3f3177e9e1a9df6b16.dll,#1
  2⤵
  PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:3544