2d27223ba136bb02b8d2e3116c10d614a75f5e3d7afb48de532b9d03506855a3

Analysis

max time kernel
136s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 19:48

Target

2d27223ba136bb02b8d2e3116c10d614a75f5e3d7afb48de532b9d03506855a3.dll
Size

1.6MB
MD5

d7a8c1954caf270fdc76a8f6dcb6a69e
SHA1

de09a46959bf3f4c1531a8aca12a3943a83592aa
SHA256

2d27223ba136bb02b8d2e3116c10d614a75f5e3d7afb48de532b9d03506855a3
SHA512

33bdaa3cd2ebd6e123cd08802a80f3391ba4bfb71e502f75f5b2402259c196792efacd720f2524d02f254526a128e5550652e2b0420a8922792b8eac2526502e
SSDEEP

49152:DrpweIpSqvpnJsnEsjRM9MCvz5lvbJ1q+4ATdmR2nbacc+qT+:JwRSqvpJuEsjRM9MCLnvbJ1qiE2nbaYZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 3508	5108	rundll32.exe	90
PID 5108 wrote to memory of 3508	5108	rundll32.exe	90
PID 5108 wrote to memory of 3508	5108	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d27223ba136bb02b8d2e3116c10d614a75f5e3d7afb48de532b9d03506855a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d27223ba136bb02b8d2e3116c10d614a75f5e3d7afb48de532b9d03506855a3.dll,#1
  2⤵
  PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3672 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:560