66cddbc1b7989250865ebbb704651c595c7ba5417fd8b21b17aa3b0649cd348d

Analysis

max time kernel
133s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:39

Target

66cddbc1b7989250865ebbb704651c595c7ba5417fd8b21b17aa3b0649cd348d.dll
Size

327KB
MD5

58534dca4ddf8cfd0fdd0e52bc9842f3
SHA1

dde2b5579677c85d1ccdf308a8b19e59bbd6e74d
SHA256

66cddbc1b7989250865ebbb704651c595c7ba5417fd8b21b17aa3b0649cd348d
SHA512

e53c509d4bae1ee26b02d2239dbee543665fdb6a276f83b0e53577f53594f16a122ef7770cffa14187b815c856f0baefe378c24e66a33ebfa49efc3595fe9886
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4AISs9Ei:EmWhND9yJz+b1FcMLmp2ATlSsd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3140 wrote to memory of 4588	3140	rundll32.exe	rundll32.exe
PID 3140 wrote to memory of 4588	3140	rundll32.exe	rundll32.exe
PID 3140 wrote to memory of 4588	3140	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66cddbc1b7989250865ebbb704651c595c7ba5417fd8b21b17aa3b0649cd348d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3140

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66cddbc1b7989250865ebbb704651c595c7ba5417fd8b21b17aa3b0649cd348d.dll,#1
2⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4076,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:8
1⤵
PID:4996