8d549b13edf2b0738f2d810deea667e23a4a0e55260436b74e3e6723d2ae2317

Analysis

max time kernel
141s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:54

Target

8d549b13edf2b0738f2d810deea667e23a4a0e55260436b74e3e6723d2ae2317.dll
Size

56KB
MD5

4a3b17209b0d42cba61363a00ba19f75
SHA1

1618a9f7ab839478f39f8ee3f0424396aef17f31
SHA256

8d549b13edf2b0738f2d810deea667e23a4a0e55260436b74e3e6723d2ae2317
SHA512

be258ad401712cd67b7f99d1c37232463886a90bd6a2b3d629f98c9158618e3538163e227953704d9e247263afed04be4285f13cca1d3f1c8cb5a482ae7a325f
SSDEEP

768:RQqXPHurp6hmY27ZbLPNmPJdmvDDDDDDDDDDDDDDDlGBn9w48Ekg55sztXy66U1r:Dap6QxvmhdmRGU48E12Ny631B7J5V

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4980 wrote to memory of 2896	4980	rundll32.exe	rundll32.exe
PID 4980 wrote to memory of 2896	4980	rundll32.exe	rundll32.exe
PID 4980 wrote to memory of 2896	4980	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d549b13edf2b0738f2d810deea667e23a4a0e55260436b74e3e6723d2ae2317.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d549b13edf2b0738f2d810deea667e23a4a0e55260436b74e3e6723d2ae2317.dll,#1
2⤵
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4172,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
1⤵
PID:4700