dd09d8fda741292b5a9432eebe261b14143dd1bb358bb544abbe88f7c2806363

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 03:18

Target

dd09d8fda741292b5a9432eebe261b14143dd1bb358bb544abbe88f7c2806363.dll
Size

44KB
MD5

8d427eaf3b96bafddec5ec09281f7d3d
SHA1

d0f30b84fdd6b90cee1a13ae576e510ad14bb751
SHA256

dd09d8fda741292b5a9432eebe261b14143dd1bb358bb544abbe88f7c2806363
SHA512

79fc772483537185b06b0428c72085d9df360c32a50f13764773858b58c118abf06d37d0d2dcc4013d79313c0628507377e6016afb74c485d846f51e77b097aa
SSDEEP

768:ZU9lDJrwqBA3ojVZwbNFUNioTAkPpHIYGDb9f9BT36rAJBt1zCVITu/:ZUPtrZ5ZwbNFUNioTG7Bfrt2ITA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 4184	4744	rundll32.exe	91
PID 4744 wrote to memory of 4184	4744	rundll32.exe	91
PID 4744 wrote to memory of 4184	4744	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd09d8fda741292b5a9432eebe261b14143dd1bb358bb544abbe88f7c2806363.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd09d8fda741292b5a9432eebe261b14143dd1bb358bb544abbe88f7c2806363.dll,#1
  2⤵
  PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:2636