636d417c4967e5b935245b89dd64b10656fe8214b3c3cdc149da0705fc466c65

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 03:00

Target

636d417c4967e5b935245b89dd64b10656fe8214b3c3cdc149da0705fc466c65.dll
Size

980KB
MD5

012aefdfa90542259103e5108ff4bba9
SHA1

6f2652f1a6a94d7eee20e0bb037cbd51779dafe7
SHA256

636d417c4967e5b935245b89dd64b10656fe8214b3c3cdc149da0705fc466c65
SHA512

ab110473410a30dbeb676f79e5653094cbf8f2d6f44414fa5020953c907e31edd7d95b2453f2b4a062023d8ef137cc639ede2bcfe7f84794d83ef975cdbb6b8c
SSDEEP

24576:nZQcaNvHu27o1i4v6sjaUwdr4M5gx6uxVNMtRqM60dXzDg:nycQvOg/XA

Score

8^/10

Blocklisted process makes network request 5 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 1520	2948	rundll32.exe	93
PID 2948 wrote to memory of 1520	2948	rundll32.exe	93
PID 2948 wrote to memory of 1520	2948	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\636d417c4967e5b935245b89dd64b10656fe8214b3c3cdc149da0705fc466c65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\636d417c4967e5b935245b89dd64b10656fe8214b3c3cdc149da0705fc466c65.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:2932