f69b781844465c25d7dedd9293d331e7b4343f96fab6b38ad9b0ea42e20c9346

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 05:50

Target

f69b781844465c25d7dedd9293d331e7b4343f96fab6b38ad9b0ea42e20c9346.dll
Size

920KB
MD5

a3518beb4823819a06d7d8e20eab193d
SHA1

1a351876d7f0ffe3fcead20940a2d9575be2dbe7
SHA256

f69b781844465c25d7dedd9293d331e7b4343f96fab6b38ad9b0ea42e20c9346
SHA512

cad09142b52bab12340fecc84c1aa07e2cc4a0a1704c2a7f1395f9c41689b4b33eb3f35f8250a9b21a275fdac0e76b8328e7aa85c837d3ace8e82ac25d0d41b6
SSDEEP

24576:amLsYROxc3T7P4rH8IRfR8VzZTHQZtlD:t/ROxc33azRfR8PTHQZt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2428	2260	rundll32.exe	91
PID 2260 wrote to memory of 2428	2260	rundll32.exe	91
PID 2260 wrote to memory of 2428	2260	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f69b781844465c25d7dedd9293d331e7b4343f96fab6b38ad9b0ea42e20c9346.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f69b781844465c25d7dedd9293d331e7b4343f96fab6b38ad9b0ea42e20c9346.dll,#1
  2⤵
  PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5520