eda1d601ef71d61b8d96fc25f9934e2c057db43a122e58ffaf84690c3fd64e4a

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 04:29

Target

eda1d601ef71d61b8d96fc25f9934e2c057db43a122e58ffaf84690c3fd64e4a.dll
Size

329KB
MD5

7a889bb8883ffa8b168342e7a09e4414
SHA1

a6812016d9b15dae031044f0db41cec5f9755b40
SHA256

eda1d601ef71d61b8d96fc25f9934e2c057db43a122e58ffaf84690c3fd64e4a
SHA512

de494148bc738ed7f4ae3ac7b44e422e9126cd305359227c2fa7340845b7e64fcf51a994a8341c2c56ca57bd863a10b4ea435fc6e358c2e9b3d9459b8a91a26a
SSDEEP

6144:smWicfSPyXTnkl+r+MHLt8TaggWQI9TXS0osu:smWip2TnGC+MHL2mgiIFXS0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4160	4848	rundll32.exe	90
PID 4848 wrote to memory of 4160	4848	rundll32.exe	90
PID 4848 wrote to memory of 4160	4848	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eda1d601ef71d61b8d96fc25f9934e2c057db43a122e58ffaf84690c3fd64e4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eda1d601ef71d61b8d96fc25f9934e2c057db43a122e58ffaf84690c3fd64e4a.dll,#1
  2⤵
  PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:3628