ef59a9c82d1724add3a2e404a5fc5cd4767fedfe1768baea74535f99d23c8a74

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 03:27

Target

ef59a9c82d1724add3a2e404a5fc5cd4767fedfe1768baea74535f99d23c8a74.dll
Size

395KB
MD5

2d80f76816c4ad9e1de52a5b1c7b21b6
SHA1

6037bfc1a90e0fc9ec67daaf30830d983b5fed05
SHA256

ef59a9c82d1724add3a2e404a5fc5cd4767fedfe1768baea74535f99d23c8a74
SHA512

210bdd3e364ccd8dbb28506a003bb42cda38be8b9483a6243dcf6b4b450ac8a6a9282848365b8b364fcee62d42352d9c98173a035304889f3599288f29a821c5
SSDEEP

6144:eWoX1d2jpCj/s5lHSnk/yxma9VYtZ+9ZaTNvHFrZfncS50JNi4HV50DErwAO3M2E:yCSIMlma9GtYrYdc40H9gD/FM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4660	4964	rundll32.exe	89
PID 4964 wrote to memory of 4660	4964	rundll32.exe	89
PID 4964 wrote to memory of 4660	4964	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef59a9c82d1724add3a2e404a5fc5cd4767fedfe1768baea74535f99d23c8a74.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef59a9c82d1724add3a2e404a5fc5cd4767fedfe1768baea74535f99d23c8a74.dll,#1
  2⤵
  PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:800