d63b65e40667524adc79c7c601999f6db514c6a5433cef92ab55ef316e693816

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 03:43

Target

d63b65e40667524adc79c7c601999f6db514c6a5433cef92ab55ef316e693816.dll
Size

690KB
MD5

fbea1e4e6422072b9ff2432c48193768
SHA1

33f412dcef0f6b103ccdbea81d32be4c28131067
SHA256

d63b65e40667524adc79c7c601999f6db514c6a5433cef92ab55ef316e693816
SHA512

ec8629ed05c3925db33ca4d5f4c9cd208974eaa97df80a7925b5668d95817f49e57385e1efb55a980af481a27b020d51ad297db8406b497e96613cabbb185f2a
SSDEEP

12288:pqN15DGPM++vNzUjNqCyrNPfowGNv0JfVkZHs0/NkZxtCerIpTJ3ZcVafbhS2PAC:pmVayw6TrkyIrHjd4g0tfe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4552	4820	rundll32.exe	92
PID 4820 wrote to memory of 4552	4820	rundll32.exe	92
PID 4820 wrote to memory of 4552	4820	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d63b65e40667524adc79c7c601999f6db514c6a5433cef92ab55ef316e693816.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d63b65e40667524adc79c7c601999f6db514c6a5433cef92ab55ef316e693816.dll,#1
  2⤵
  PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4124 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:4768