cb32e6dcd6c66c565fbe16d777921daee97420eb3b750dadfa90ac13842a9082

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 13:37

Target
cb32e6dcd6c66c565fbe16d777921daee97420eb3b750dadfa90ac13842a9082.dll
Size 2.5MB
Sample240613-qws8aavfpj
SHA256 cb32e6dcd6c66c565fbe16d777921daee97420eb3b750dadfa90ac13842a9082
MD5 5e112e1ab755fb66d6abc197fb4cafbb
SHA1 817e49e9b2353a9d9a2ef80e07e47d5852265396
SHA512 8974765c277471d57648ea68a313317207031b5efa0f643d4885a4c632775cf1c830d4cd05bfbebf96e643b1a5024609153256633d1702c5bedca6e4feace04f
SSDEEP 49152:6udNz2fZHghOpzzU0esw7LPtJ0WyKaNxBqHcTxaIF7cYc+T5vGn1v0Ax851:6gNz8zzUDswdJyTxaIJlcve1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 2260	3348	rundll32.exe	90
PID 3348 wrote to memory of 2260	3348	rundll32.exe	90
PID 3348 wrote to memory of 2260	3348	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb32e6dcd6c66c565fbe16d777921daee97420eb3b750dadfa90ac13842a9082.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb32e6dcd6c66c565fbe16d777921daee97420eb3b750dadfa90ac13842a9082.dll,#1
  2⤵
  PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:4572