4fe6cc8957f07517f164a86d958ee85da99a076f180f5da3fa5313b3de0c9499

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 22:43

Target

4fe6cc8957f07517f164a86d958ee85da99a076f180f5da3fa5313b3de0c9499.dll
Size

194KB
MD5

37d9373342ac9966dca03a1b0faccdc0
SHA1

9c99f1cb1cb1a91eb420bd3e3ecde7d980bb1485
SHA256

4fe6cc8957f07517f164a86d958ee85da99a076f180f5da3fa5313b3de0c9499
SHA512

96c3141cf49c68241fd13148dc38842928d64c2ba5a6ccddb6cf0bf8ae8ccbbcf73cbf6654563a96dba1021518098602cf16e4e603037aa801c3674c26816898
SSDEEP

6144:k4Cfd9aQGAWB5SA7nhVB4iGJqKK+M2M/V:Id9DWb7nh0q8M/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 4148	1348	rundll32.exe	91
PID 1348 wrote to memory of 4148	1348	rundll32.exe	91
PID 1348 wrote to memory of 4148	1348	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fe6cc8957f07517f164a86d958ee85da99a076f180f5da3fa5313b3de0c9499.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fe6cc8957f07517f164a86d958ee85da99a076f180f5da3fa5313b3de0c9499.dll,#1
  2⤵
  PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:5084