9d48aa42cac849d50f3dd1c7da881a301849b635068d549641fcafd4d7d75157

Analysis

max time kernel
131s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 00:39

Target

9d48aa42cac849d50f3dd1c7da881a301849b635068d549641fcafd4d7d75157.dll
Size

16KB
MD5

39bf7b295c6fb285675ecae5b7d84cc6
SHA1

133a14770c3fdf165d0b3cc9a14a3029b053247f
SHA256

9d48aa42cac849d50f3dd1c7da881a301849b635068d549641fcafd4d7d75157
SHA512

d3c385e47299804b6f9e0ffe5705581e3979ba534efea382795325f562ccd4922a00599aff7329d233649a7f72f7c5336e0696bc70e3a4f688b19f9208602206
SSDEEP

384:WlGAq8xdLSggxpWkdIjlxn1bH+jQtQL6K:WlNdLtgxpWRbH+IER

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4308	4988	rundll32.exe	90
PID 4988 wrote to memory of 4308	4988	rundll32.exe	90
PID 4988 wrote to memory of 4308	4988	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d48aa42cac849d50f3dd1c7da881a301849b635068d549641fcafd4d7d75157.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d48aa42cac849d50f3dd1c7da881a301849b635068d549641fcafd4d7d75157.dll,#1
  2⤵
  PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1300,i,17325488789339133686,9539570259395798500,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:8
1⤵
PID:4272