bf5764b1113287ac1245af5a337410513756a0ef13b049ec92d7f85321efeadc

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:33

Target

bf5764b1113287ac1245af5a337410513756a0ef13b049ec92d7f85321efeadc.dll
Size

329KB
MD5

565b757aa2f3b30555001628bd32b16b
SHA1

ba2efcb82e015754dc505f82e7a3cba3f0b00f23
SHA256

bf5764b1113287ac1245af5a337410513756a0ef13b049ec92d7f85321efeadc
SHA512

fc5e4fae9f6adfd7c949929bf4868d2263ebd6f109ece9228c8379c75aca6702b8a57b9c2a3c5b796deba57761a3766a714a15e1ba588c530c889ec517541716
SSDEEP

6144:RLmWnuNrNVUvPEmRyWHj8MVloEh5QLxCSPGIsTPNctYy6egz8zZ4SUcXgZ4oi:RLmWuNrNVUXEYDQL5JsL+2DN8F4SUy0i

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4664 wrote to memory of 4744	4664	rundll32.exe	rundll32.exe
PID 4664 wrote to memory of 4744	4664	rundll32.exe	rundll32.exe
PID 4664 wrote to memory of 4744	4664	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf5764b1113287ac1245af5a337410513756a0ef13b049ec92d7f85321efeadc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf5764b1113287ac1245af5a337410513756a0ef13b049ec92d7f85321efeadc.dll,#1
  2⤵
  PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:1148