7663f0650a510869a9c98ea30fec726e845f79e70ae2923487f1e77e70b62f7a

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:19

Target

7663f0650a510869a9c98ea30fec726e845f79e70ae2923487f1e77e70b62f7a.dll
Size

6KB
MD5

e4e1aad4fc26839c6ec990148e46a320
SHA1

db91dd7fda229db574ebdc032d5d9a12910088fd
SHA256

7663f0650a510869a9c98ea30fec726e845f79e70ae2923487f1e77e70b62f7a
SHA512

1b2c7e40c3a56420c4a3f5b407f2594730292f9df4c94fbc46b9678976539d06f6fe6c05ed1228e291c20d5f1a6b13807e9bb8865115a951596240494d5991d1
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G0edB+BDq9J5S2:0QDV8FscMjsLFV3GdB+FqX5S2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4140 wrote to memory of 4656	4140	rundll32.exe	rundll32.exe
PID 4140 wrote to memory of 4656	4140	rundll32.exe	rundll32.exe
PID 4140 wrote to memory of 4656	4140	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7663f0650a510869a9c98ea30fec726e845f79e70ae2923487f1e77e70b62f7a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4140

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7663f0650a510869a9c98ea30fec726e845f79e70ae2923487f1e77e70b62f7a.dll,#1
2⤵
PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:2312