122f13fcffd3a8747c05829fa21c72dbda254412d88e43625906915f1b9ef4cb

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 01:08

Target

122f13fcffd3a8747c05829fa21c72dbda254412d88e43625906915f1b9ef4cb.dll
Size

24.5MB
MD5

e6a1b79aceb1a98016c6edcf8f3d0a65
SHA1

bddca6de5c54d2c38d78a102c05fd3bc89c7adf1
SHA256

122f13fcffd3a8747c05829fa21c72dbda254412d88e43625906915f1b9ef4cb
SHA512

ad7c62e12a6727b6327248f1d2d12b074269e72d249f52b5bc7991156c0f7f9882c911011a13a54ae501c68d5d378c182fa84c97d28c391fb2da3f56774a7d2d
SSDEEP

786432:BIIIIIIIvIIIIIII8ycgIs9wRX+LwtJ0a+XOU094IdJ3ar1KlcWuVy:BIIIIIIIvIIIIIII8ygxcO0acOUWdFam

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3620	4268	rundll32.exe	91
PID 4268 wrote to memory of 3620	4268	rundll32.exe	91
PID 4268 wrote to memory of 3620	4268	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\122f13fcffd3a8747c05829fa21c72dbda254412d88e43625906915f1b9ef4cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\122f13fcffd3a8747c05829fa21c72dbda254412d88e43625906915f1b9ef4cb.dll,#1
  2⤵
  PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:4308

memory/3620-0-0x0000000010000000-0x0000000010088000-memory.dmp

Filesize
544KB

Download