deb1c369bd30185842242936e1e2b51bf5de9a7f6ec9db11db7f9597ef1e1427

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 03:01

Target

deb1c369bd30185842242936e1e2b51bf5de9a7f6ec9db11db7f9597ef1e1427.dll
Size

6KB
MD5

868bb70ddedd40b8c6a4cf133e2c053c
SHA1

648e4816e10a96cbb13409d970a07cfb4bbf2f00
SHA256

deb1c369bd30185842242936e1e2b51bf5de9a7f6ec9db11db7f9597ef1e1427
SHA512

8828058b706a50750f5c8fc9e6901481e0dad78a1474b9764e925a95e8d8244ef760e612e9436d3675b809d31d8a86cf0bef89f32d8152f02521c4efbb4d8314
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0gB+BDq9J5SH:VDa9VUX9bQWAB+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 3352	3964	rundll32.exe	91
PID 3964 wrote to memory of 3352	3964	rundll32.exe	91
PID 3964 wrote to memory of 3352	3964	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\deb1c369bd30185842242936e1e2b51bf5de9a7f6ec9db11db7f9597ef1e1427.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\deb1c369bd30185842242936e1e2b51bf5de9a7f6ec9db11db7f9597ef1e1427.dll,#1
  2⤵
  PID:3352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:1516