8f0f486dacb0299b4ca4467528e50fc05792a5c2bd9f3898b4180874c1102701

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:18

Target

8f0f486dacb0299b4ca4467528e50fc05792a5c2bd9f3898b4180874c1102701.dll
Size

81KB
MD5

54df3658f306908189895050cd53b175
SHA1

c2b842995f7b18a44cdd65734e9dcd8fcfb167a8
SHA256

8f0f486dacb0299b4ca4467528e50fc05792a5c2bd9f3898b4180874c1102701
SHA512

2a965f8bccf09460585c119df818439b3d295e09edd9758cd595e07afdb41a9f75fc205e6fbd1d2939044cba48b789c6ab1cecdf7746f3c84793eb6bc1a5bdaa
SSDEEP

1536:ktByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wv:k4v4JKXTx71w0ArSsXF3enq8Wv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4752 wrote to memory of 1804	4752	rundll32.exe	rundll32.exe
PID 4752 wrote to memory of 1804	4752	rundll32.exe	rundll32.exe
PID 4752 wrote to memory of 1804	4752	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f0f486dacb0299b4ca4467528e50fc05792a5c2bd9f3898b4180874c1102701.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f0f486dacb0299b4ca4467528e50fc05792a5c2bd9f3898b4180874c1102701.dll,#1
2⤵
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4060