5f6d86a873e8a2ce8f2760f2cc1a6f6c7a765d08b831565c25492852c87da40e

Analysis

max time kernel
133s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:12

Target

5f6d86a873e8a2ce8f2760f2cc1a6f6c7a765d08b831565c25492852c87da40e.dll
Size

5KB
MD5

f42c6abb9a2fe972827b304fafc5c840
SHA1

f427e77b1c505245f33673abd89ef6ff03eccb7e
SHA256

5f6d86a873e8a2ce8f2760f2cc1a6f6c7a765d08b831565c25492852c87da40e
SHA512

e81079d89fbe996021d80e47905b41bcdd343d1d21104727350e597a6a9103c73dfc0fe49c733a25fae50101e7578bde5371e007fbad5d8a27c709df85fbc77a
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEql7A03gMAPyczdcWAa04d4ggnbn7zl2Mkgy:hy859x0P8MaKSAPBAzRzl29

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1952 wrote to memory of 4288	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 4288	1952	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 4288	1952	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f6d86a873e8a2ce8f2760f2cc1a6f6c7a765d08b831565c25492852c87da40e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f6d86a873e8a2ce8f2760f2cc1a6f6c7a765d08b831565c25492852c87da40e.dll,#1
2⤵
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4440,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
1⤵
PID:1560