f0a7fc685747beb21d9339aed02eb9f7ee85996d79d226858fea8c2f83af36cc

Analysis

max time kernel
144s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 14:52

Target

f0a7fc685747beb21d9339aed02eb9f7ee85996d79d226858fea8c2f83af36cc.dll
Size

1.6MB
MD5

0dc2d819a6d1d34e4a7b0fdc6f5cb17b
SHA1

5d6199f6f9b7d6d2e94312c50cd27c2220ae16de
SHA256

f0a7fc685747beb21d9339aed02eb9f7ee85996d79d226858fea8c2f83af36cc
SHA512

a8b0bfd5800b5450fd2df398d1fd06448195a24891108ce6f946a14969d004883909c3a16eafd793146510eefcbb75db136fac158361a41b23b3e6c70feebecd
SSDEEP

24576:MOfORMz7IuYbwvSB2ks/6IPIWX1bIEgDB0l2vZrU2:KMzsse2ks/bPX1svB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 3604	4060	rundll32.exe	93
PID 4060 wrote to memory of 3604	4060	rundll32.exe	93
PID 4060 wrote to memory of 3604	4060	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0a7fc685747beb21d9339aed02eb9f7ee85996d79d226858fea8c2f83af36cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0a7fc685747beb21d9339aed02eb9f7ee85996d79d226858fea8c2f83af36cc.dll,#1
  2⤵
  PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2808 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:2228

memory/3604-0-0x0000000000FE0000-0x0000000000FE6000-memory.dmp

Filesize
24KB

Download
memory/3604-1-0x0000000000400000-0x00000000005A6000-memory.dmp

Filesize
1.6MB

Download
memory/3604-5-0x0000000002FF0000-0x00000000030AD000-memory.dmp

Filesize
756KB

Download
memory/3604-6-0x00000000030B0000-0x0000000003158000-memory.dmp

Filesize
672KB

Download
memory/3604-9-0x00000000030B0000-0x0000000003158000-memory.dmp

Filesize
672KB

Download
memory/3604-10-0x00000000030B0000-0x0000000003158000-memory.dmp

Filesize
672KB

Download
memory/3604-11-0x0000000000400000-0x00000000005A6000-memory.dmp

Filesize
1.6MB

Download