b2e810ef38022588c0b808af709c021218b4b125ca756f7415d7b51a236d5da1

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 07:08

Target
b2e810ef38022588c0b808af709c021218b4b125ca756f7415d7b51a236d5da1.dll
Size 6KB
Sample240609-hygchagb39
SHA256 b2e810ef38022588c0b808af709c021218b4b125ca756f7415d7b51a236d5da1
MD5 ee17eef16066badd497005f4a09c8a44
SHA1 cdb6ad9c9d65c2ac5287c46206e11cd3cc4470fe
SHA512 8c7b6017efef4797b6238988758a64c25c73abbc739f88573642e70388a221d977461a5b372688c90dfe82c8490dc673f63a18d088d6bd499cf393b29dff4f7f
SSDEEP 96:nEY2RrF1eqwi4JEVvYVFeZ000ZGdMMMMMMMa1K:EHRh1epp7cZ000gMMMMMMM
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 1604	628	rundll32.exe	91
PID 628 wrote to memory of 1604	628	rundll32.exe	91
PID 628 wrote to memory of 1604	628	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2e810ef38022588c0b808af709c021218b4b125ca756f7415d7b51a236d5da1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2e810ef38022588c0b808af709c021218b4b125ca756f7415d7b51a236d5da1.dll,#1
  2⤵
  PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:2528