3e6b346ead74f7e8077c910783ff540e06a094cb367a729b9d6795ca54745bc9

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 20:50

Target

3e6b346ead74f7e8077c910783ff540e06a094cb367a729b9d6795ca54745bc9.dll
Size

6KB
MD5

e74f8427bf2ecb3e3d73f7e2c032d754
SHA1

278a4934ee5953c9ad23a2f4357564dadf890e18
SHA256

3e6b346ead74f7e8077c910783ff540e06a094cb367a729b9d6795ca54745bc9
SHA512

7c6539854552418d09b908eb6aab1431b20339cca5d9749f99f39063de2de70a9e68e6e075dca6bbad61544fe5f84ddebe582397abff15f36686d53f3247aa18
SSDEEP

96:hy859x0P8Mae9LRtdckZ7Q8Z5tQ5g8+2:F5oLbr0+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 3544	1260	rundll32.exe	91
PID 1260 wrote to memory of 3544	1260	rundll32.exe	91
PID 1260 wrote to memory of 3544	1260	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e6b346ead74f7e8077c910783ff540e06a094cb367a729b9d6795ca54745bc9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e6b346ead74f7e8077c910783ff540e06a094cb367a729b9d6795ca54745bc9.dll,#1
  2⤵
  PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4252 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4904