1c64533afbc642027f4d2d9291043b7202bbe246cef19c75b1340c4150da5883

Analysis

max time kernel
137s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 19:21

Target

1c64533afbc642027f4d2d9291043b7202bbe246cef19c75b1340c4150da5883.dll
Size

81KB
MD5

6631a2d665527d21efc84f21435c3866
SHA1

a66730fc3ee42c771e1a3a1d38a6d3b4e92555b3
SHA256

1c64533afbc642027f4d2d9291043b7202bbe246cef19c75b1340c4150da5883
SHA512

795ffcf9520a6a13ed6d9f375300615d429ac152bebbfcb85c5f1dfcbd322d871e49dfc18b8acd4444c6c984683845a4811f17128c4d1e986a89da68806da824
SSDEEP

1536:xtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WM:x4v4JKXTx71w0ArSsXF3enq8WM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 4528	332	rundll32.exe	92
PID 332 wrote to memory of 4528	332	rundll32.exe	92
PID 332 wrote to memory of 4528	332	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c64533afbc642027f4d2d9291043b7202bbe246cef19c75b1340c4150da5883.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c64533afbc642027f4d2d9291043b7202bbe246cef19c75b1340c4150da5883.dll,#1
  2⤵
  PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3676 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4500