e15fb2a8102195b01d981c0712e98092f6edeb3c248289a8e2f47a22d91204bd

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 04:34

Target
e15fb2a8102195b01d981c0712e98092f6edeb3c248289a8e2f47a22d91204bd.dll
Size 6KB
Sample240511-e7jx7sgb99
SHA256 e15fb2a8102195b01d981c0712e98092f6edeb3c248289a8e2f47a22d91204bd
MD5 26670f2fb05fce63820a843c064c6cab
SHA1 8873ec50ab85653b7ef6cbf4757911c0afaab080
SHA512 6ea7099d19a56ce5d18cf90970c71d0c542afcf45b5c79ac54dfa17fe51ec7cf3b374ac784a7715d9e8b60b52eacff24a56e92c22135f1465ed5f231a3703ef3
SSDEEP 96:nEY2RrF1eqwi4r4tlsRqc02Fjs2H95x8DK3dWIdmL8kFlcJ:EHRh1eppr4nsJIIZ3AJFlcJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 3688	3008	rundll32.exe	90
PID 3008 wrote to memory of 3688	3008	rundll32.exe	90
PID 3008 wrote to memory of 3688	3008	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e15fb2a8102195b01d981c0712e98092f6edeb3c248289a8e2f47a22d91204bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e15fb2a8102195b01d981c0712e98092f6edeb3c248289a8e2f47a22d91204bd.dll,#1
  2⤵
  PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4336,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
1⤵
PID:3508