821441211cacebc6e8db18fc9f033520491bb15ae520d130fdc1f8f88badcb76

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 02:44

Target

66480aab75eb380ce9c1ede4e9f0d855534bad0921e8fbc467dadb7b41225075.dll
Size

6.3MB
MD5

c05e22b288ae1ab8bb88f595d61dff5c
SHA1

d5e7cc245edf3671b20a7b2de8e54de0bf125ce8
SHA256

66480aab75eb380ce9c1ede4e9f0d855534bad0921e8fbc467dadb7b41225075
SHA512

ced4123cab29c992bf9a94a46eab1c05ef9bba262ee47ec8ae39fd7dc82f616b1b18afa088cb34967d036479f04b62c250a09c9a853424a1b067e3919012efa0
SSDEEP

98304:A3noUtXsq6DWt7mSn/LwWYOVNFC1e9oaEWDg:AYUQDWt7mS/LwWYOVNFCso5WM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 3124	3516	rundll32.exe	89
PID 3516 wrote to memory of 3124	3516	rundll32.exe	89
PID 3516 wrote to memory of 3124	3516	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66480aab75eb380ce9c1ede4e9f0d855534bad0921e8fbc467dadb7b41225075.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66480aab75eb380ce9c1ede4e9f0d855534bad0921e8fbc467dadb7b41225075.dll,#1
  2⤵
  PID:3124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3980,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
1⤵
PID:1536