Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/02/2024, 00:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad396660e76325e77a452cd691d8dbb0.dll
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ad396660e76325e77a452cd691d8dbb0.dll
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
ad396660e76325e77a452cd691d8dbb0.dll
-
Size
276KB
-
MD5
ad396660e76325e77a452cd691d8dbb0
-
SHA1
05c500bd86937aeea906a80e9bbb49f3cea96623
-
SHA256
772e21b5978eb84b5e916df9a3ab35b602f9a9ab012c4569ed21f1ff8bf9848b
-
SHA512
763f8f0c9872dd4baef6663a46358c3c639ce48437f7db8a5b64ffe644355fed9b32f85cfac028a599b0b2846804d3772187847cc814bd26218744c05a59bd08
-
SSDEEP
3072:OrMoYOJ3KyY0kbVI7fpya6W8FFP3VnSpJxS6nTGcT/59nKG4BWLZqjLU1ZtFY5:OTxkpIVYS46tTDAj8hY
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2928 1820 rundll32.exe 96 PID 1820 wrote to memory of 2928 1820 rundll32.exe 96 PID 1820 wrote to memory of 2928 1820 rundll32.exe 96
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad396660e76325e77a452cd691d8dbb0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad396660e76325e77a452cd691d8dbb0.dll,#12⤵PID:2928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3640 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵PID:1620