efade7cf8f2caeb5a5d1cf647796975b0b153feac67217fccbdd203e473a4928

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 14:52

Target

efade7cf8f2caeb5a5d1cf647796975b0b153feac67217fccbdd203e473a4928.dll
Size

3.1MB
MD5

7b7e78fe4e6f99ff203627c5fb9c9878
SHA1

8d82bb3f64a8874b8161f03210d71483b8f26584
SHA256

efade7cf8f2caeb5a5d1cf647796975b0b153feac67217fccbdd203e473a4928
SHA512

9ad441c4611a5cd998a529d7902ef191e90fa1d2594c78539c3d96883fdfd75140ab6bd10df67c5a99d3c3d54ea9fc9065d7f2de731a5ca9c3d3716efdd7255a
SSDEEP

98304:+AWhqZ2OkiCamAgll4ECLCSJ5ka7LF+I:bWhDOGamAgn4ECLCSJ5ka7LF+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2428	2260	rundll32.exe	91
PID 2260 wrote to memory of 2428	2260	rundll32.exe	91
PID 2260 wrote to memory of 2428	2260	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\efade7cf8f2caeb5a5d1cf647796975b0b153feac67217fccbdd203e473a4928.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\efade7cf8f2caeb5a5d1cf647796975b0b153feac67217fccbdd203e473a4928.dll,#1
  2⤵
  PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3100 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5980