ca9d00594aa601821c0e1d1fc20dc66cac593718b33a1ee6d51076f6f44f2fcb

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 03:53

Target
ca9d00594aa601821c0e1d1fc20dc66cac593718b33a1ee6d51076f6f44f2fcb.dll
Size 81KB
Sample240423-ef3k8scf9v
SHA256 ca9d00594aa601821c0e1d1fc20dc66cac593718b33a1ee6d51076f6f44f2fcb
MD5 d2d35e0ecd79676d572991083d954fc6
SHA1 b69ed91c2b59f723da92107d0afdf83508444e0a
SHA512 9badb8e8731d62a7c8450f5bb4303fc05c948458866c41b6b5c25f46d79e503746a23e059bd6bf70598f153f9774daf92b871c5a0bfb291961fc3860a990ffdb
SSDEEP 1536:NByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8W5:Yv4JKXTx71wnArSsXFpeXq8W5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3292	5088	rundll32.exe	92
PID 5088 wrote to memory of 3292	5088	rundll32.exe	92
PID 5088 wrote to memory of 3292	5088	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca9d00594aa601821c0e1d1fc20dc66cac593718b33a1ee6d51076f6f44f2fcb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca9d00594aa601821c0e1d1fc20dc66cac593718b33a1ee6d51076f6f44f2fcb.dll,#1
  2⤵
  PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1404 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:4768