a414a2fa44924b7a0130eee526a3a5290e70dcf287fc038ea42a373923e232e7

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 13:20

Target
b77f4c99a3754f74523e20201ccef405.dll
Size 61KB
Sample240306-qlebdacg79
SHA256 a414a2fa44924b7a0130eee526a3a5290e70dcf287fc038ea42a373923e232e7
MD5 b77f4c99a3754f74523e20201ccef405
SHA1 cbf15a4d3016baa5718e5600704afac0f2283505
SHA512 9a14b80fce303012010432550791e2c8382ac384393d888818650cede7da7b2e5b9e42470949770aab664429875dfa214d4a9758346b04064d90c7a01672e8cb
SSDEEP 1536:1GrcDw0TyI2+r0ufPACatj05+qOCWWcqhxdzFgJR:1xTTR34Ca1JcWWBhpgz
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 26 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 932	1968	rundll32.exe	96
PID 1968 wrote to memory of 932	1968	rundll32.exe	96
PID 1968 wrote to memory of 932	1968	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b77f4c99a3754f74523e20201ccef405.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b77f4c99a3754f74523e20201ccef405.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3592 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:1620

memory/932-0-0x0000000010000000-0x0000000010057000-memory.dmp

Download