3a744a9c2f67eb6f0808b5dde23d423f3f25f6782101c82b472934b39542fb48

Analysis

max time kernel
139s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:35

Target

3a744a9c2f67eb6f0808b5dde23d423f3f25f6782101c82b472934b39542fb48.dll
Size

2.0MB
MD5

8fb885f1bb62ca4890b18ffb669a98f1
SHA1

ea718bef35dae290d7ffca03f485b9a457002779
SHA256

3a744a9c2f67eb6f0808b5dde23d423f3f25f6782101c82b472934b39542fb48
SHA512

1ebacf74c77787c3777a37bfd5dc14fbb154a9406e3a69219bab4737bd8fd620bf3a7723e45e9c816a9db91a7b8b6713e3054fbe91e6cd110c2fe9702cc7223f
SSDEEP

49152:4FIbdyf/v1yuEC3GgwqlVi9/6pNMEhJL1Hvr+:QIbg/hmgwqlVi9/6pv+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 584 wrote to memory of 3084	584	rundll32.exe	rundll32.exe
PID 584 wrote to memory of 3084	584	rundll32.exe	rundll32.exe
PID 584 wrote to memory of 3084	584	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a744a9c2f67eb6f0808b5dde23d423f3f25f6782101c82b472934b39542fb48.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a744a9c2f67eb6f0808b5dde23d423f3f25f6782101c82b472934b39542fb48.dll,#1
2⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
1⤵
PID:2184