0645355f77b2a248ea440a233e2ccf1741899a0411e82a6273e89d8e42189919

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 18:25

Target
0645355f77b2a248ea440a233e2ccf1741899a0411e82a6273e89d8e42189919.dll
Size 7KB
Sample240512-w2rvasdb33
SHA256 0645355f77b2a248ea440a233e2ccf1741899a0411e82a6273e89d8e42189919
MD5 aa4d9b772aabaa605cc77ac60c288eec
SHA1 fbd031ed9a71de2d36edf8758709dde2f4a5abd9
SHA512 5c532de5bbc3c202f02dbacd8a7b2b3eb29131a650defae71a46da237060a0d5a9f42cc9212e2a4f1e44ac81ac91c2306b2588af9e12f6c07ab308448e7a7ee0
SSDEEP 96:Ts1Wnnnynnnnnnnn6nnann7nnXnnbnnKniROiAh78hjaV4s7VQKWPrObhOO3xNUe:YXA4GVJV7WPcwAxNgektVc1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 224	2160	rundll32.exe	90
PID 2160 wrote to memory of 224	2160	rundll32.exe	90
PID 2160 wrote to memory of 224	2160	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0645355f77b2a248ea440a233e2ccf1741899a0411e82a6273e89d8e42189919.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0645355f77b2a248ea440a233e2ccf1741899a0411e82a6273e89d8e42189919.dll,#1
  2⤵
  PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:4104