70e5109af4244556cd56b96d00375d904a95bfba1859404083559ab17f823513

Analysis

max time kernel
138s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 11:00

Target

70e5109af4244556cd56b96d00375d904a95bfba1859404083559ab17f823513.dll
Size

10.2MB
MD5

c22d728d255946a4b6d131eb7cc37e46
SHA1

23e5f6dd7bb7bec572da168cda9a0a1d709eae21
SHA256

70e5109af4244556cd56b96d00375d904a95bfba1859404083559ab17f823513
SHA512

70a4a0aac8d483a50f4929effcd74393aa6b12714edb762687cfb86ec2641cab5110cbbcaeb130373487e89932028693bd916e12ffa779329cdcf98746ccaaba
SSDEEP

6144:lVhfAMdKaIxLCpcuYQ7f4qs4j4444444+xO:67aIxLuH7jsS4444444AO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1856	2388	rundll32.exe	91
PID 2388 wrote to memory of 1856	2388	rundll32.exe	91
PID 2388 wrote to memory of 1856	2388	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70e5109af4244556cd56b96d00375d904a95bfba1859404083559ab17f823513.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\70e5109af4244556cd56b96d00375d904a95bfba1859404083559ab17f823513.dll,#1
  2⤵
  PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3792 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:4372

memory/1856-0-0x0000000001090000-0x0000000001091000-memory.dmp

Filesize
4KB

Download