66480aab75eb380ce9c1ede4e9f0d855534bad0921e8fbc467dadb7b41225075

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:20

Target
66480aab75eb380ce9c1ede4e9f0d855534bad0921e8fbc467dadb7b41225075.dll
Size 6.3MB
Sample240613-bqhf9sseqp
SHA256 66480aab75eb380ce9c1ede4e9f0d855534bad0921e8fbc467dadb7b41225075
MD5 c05e22b288ae1ab8bb88f595d61dff5c
SHA1 d5e7cc245edf3671b20a7b2de8e54de0bf125ce8
SHA512 ced4123cab29c992bf9a94a46eab1c05ef9bba262ee47ec8ae39fd7dc82f616b1b18afa088cb34967d036479f04b62c250a09c9a853424a1b067e3919012efa0
SSDEEP 98304:A3noUtXsq6DWt7mSn/LwWYOVNFC1e9oaEWDg:AYUQDWt7mS/LwWYOVNFCso5WM
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 4748	824	rundll32.exe	90
PID 824 wrote to memory of 4748	824	rundll32.exe	90
PID 824 wrote to memory of 4748	824	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66480aab75eb380ce9c1ede4e9f0d855534bad0921e8fbc467dadb7b41225075.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66480aab75eb380ce9c1ede4e9f0d855534bad0921e8fbc467dadb7b41225075.dll,#1
  2⤵
  PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2924