e40df975936ac5a38f9eda4cc97389111ffb1c72f618d0b4c966423807f24c07

Analysis

max time kernel
126s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 04:49

Target

e40df975936ac5a38f9eda4cc97389111ffb1c72f618d0b4c966423807f24c07.dll
Size

81KB
MD5

6ce3d235dfa72f150607b79cd92931ee
SHA1

5eb9efa41a7a129379cb80f43ec252ef7ce25ce4
SHA256

e40df975936ac5a38f9eda4cc97389111ffb1c72f618d0b4c966423807f24c07
SHA512

a444a8dd42cf8b77c034c2084bd2fb286f1cb3fc1c3dcefcca5586c7f5a555ca48f800aa8acea4974bbe956f65eee9ad8d1400fef0d01141fa6d1bc5d5e65178
SSDEEP

1536:AtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WO:A4v4JKXTx71w0ArSsXF3enq8WO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 4264	2560	rundll32.exe	90
PID 2560 wrote to memory of 4264	2560	rundll32.exe	90
PID 2560 wrote to memory of 4264	2560	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e40df975936ac5a38f9eda4cc97389111ffb1c72f618d0b4c966423807f24c07.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e40df975936ac5a38f9eda4cc97389111ffb1c72f618d0b4c966423807f24c07.dll,#1
  2⤵
  PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1392,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8
1⤵
PID:5056