0109c3a05ba08caff3e9d8df72af0c1df6dc4acbbf128b2ca909e7157025316b

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 19:01

Target

0109c3a05ba08caff3e9d8df72af0c1df6dc4acbbf128b2ca909e7157025316b.dll
Size

51KB
MD5

8902fa774c203e589a55d9aab058d434
SHA1

416bbbdde0c85d961a1cabafed709c85e38e9619
SHA256

0109c3a05ba08caff3e9d8df72af0c1df6dc4acbbf128b2ca909e7157025316b
SHA512

3882004719c74185d6bfbc305cb41531a75a67a4625c485e8ec0e7adead5920acb2697ecc15f3402b5c9a760b068b98af16440997ec265abf140fd406b268539
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL7JYH5:1dWubF3n9S91BF3fbofJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4500	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 4500	368	rundll32.exe	94
PID 368 wrote to memory of 4500	368	rundll32.exe	94
PID 368 wrote to memory of 4500	368	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0109c3a05ba08caff3e9d8df72af0c1df6dc4acbbf128b2ca909e7157025316b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0109c3a05ba08caff3e9d8df72af0c1df6dc4acbbf128b2ca909e7157025316b.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3224 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:3532