558773cb6a167d5ab17f37b30b80afa7b9c2c3aef5cd17d56fd57c952954cb3f

Analysis

max time kernel
125s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 22:00

Target

558773cb6a167d5ab17f37b30b80afa7b9c2c3aef5cd17d56fd57c952954cb3f.dll
Size

6KB
MD5

9a810e178c086d39716dc5808c9653df
SHA1

c62db970d00da558aa55c47f32e94bd07718b547
SHA256

558773cb6a167d5ab17f37b30b80afa7b9c2c3aef5cd17d56fd57c952954cb3f
SHA512

df26280a64e22acd7373a470d67c4d2b78d6cadc1877f8ffada0030e8302a54f589057abde4170d101d51eb908a8ce7e5020cab864ce9d7d145bec9a6a756665
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0yB+BDq9J5SH:VDa9VUX9bQWSB+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 4700	1772	rundll32.exe	89
PID 1772 wrote to memory of 4700	1772	rundll32.exe	89
PID 1772 wrote to memory of 4700	1772	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\558773cb6a167d5ab17f37b30b80afa7b9c2c3aef5cd17d56fd57c952954cb3f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\558773cb6a167d5ab17f37b30b80afa7b9c2c3aef5cd17d56fd57c952954cb3f.dll,#1
  2⤵
  PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3896,i,9197556651587249039,2664027599321555186,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:8
1⤵
PID:1336