75391f55b84cd14458cac7d6af345a4564691e5aaaaf9ab1dec28dadaf1a5277

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 23:06

Target

75391f55b84cd14458cac7d6af345a4564691e5aaaaf9ab1dec28dadaf1a5277.dll
Size

6KB
MD5

ea99b6492fc6ab9cbe7da9ffeeb14766
SHA1

b52799620be54ec62233b76d9c988039ee67beeb
SHA256

75391f55b84cd14458cac7d6af345a4564691e5aaaaf9ab1dec28dadaf1a5277
SHA512

3cc5e4cb7db547399881e7847aa5243f5f46d556b7e8360f2578eaa5b875e141b26756b8d54f70d252af107593c2c79bf9e44ef096be48528b56e1321235b003
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIqfQyZbtZpfHwSQwGAGp/a:unSR6bgY9frZxZp+dpS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 1968	2640	rundll32.exe	91
PID 2640 wrote to memory of 1968	2640	rundll32.exe	91
PID 2640 wrote to memory of 1968	2640	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75391f55b84cd14458cac7d6af345a4564691e5aaaaf9ab1dec28dadaf1a5277.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\75391f55b84cd14458cac7d6af345a4564691e5aaaaf9ab1dec28dadaf1a5277.dll,#1
  2⤵
  PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2804 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:4460