f096ea49cb9168e789df7c5555b3a7f2a239db51e48b144ed8eb7da942da104a

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:47

Target

f096ea49cb9168e789df7c5555b3a7f2a239db51e48b144ed8eb7da942da104a.dll
Size

7KB
MD5

97f6a2f4561d95814582984c17bd582f
SHA1

9e6d957718a5643095358b012a4f85f841bf270a
SHA256

f096ea49cb9168e789df7c5555b3a7f2a239db51e48b144ed8eb7da942da104a
SHA512

61d90788b66d3890979faa5714b56d528d2261b419dc0f59f4378c0094cef7e1fa2bc19e6ee2716d5d254dc01813c9e6a36b5b610efff46e3488db07defe124a
SSDEEP

96:DixZjmjtjd8jPjcZGR5TI4xLUaRpTUIrHXv5KbMdyw:unSR6bgYvxLU+UI7Xv5KbMdy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 2640	4472	rundll32.exe	91
PID 4472 wrote to memory of 2640	4472	rundll32.exe	91
PID 4472 wrote to memory of 2640	4472	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f096ea49cb9168e789df7c5555b3a7f2a239db51e48b144ed8eb7da942da104a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f096ea49cb9168e789df7c5555b3a7f2a239db51e48b144ed8eb7da942da104a.dll,#1
  2⤵
  PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1712 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:892