5554fff43d58d9d93e0138fab2ee34dc48247374a7fcca34a07fbb32a8eed1dc

Analysis

max time kernel
154s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 15:08

Target

5554fff43d58d9d93e0138fab2ee34dc48247374a7fcca34a07fbb32a8eed1dc.dll
Size

899KB
MD5

5a982957bd5ff732782d2a13cd55eda5
SHA1

1682c40a34ffe83e4852a7a123a6bd3eda2d952a
SHA256

5554fff43d58d9d93e0138fab2ee34dc48247374a7fcca34a07fbb32a8eed1dc
SHA512

82c67966c38c021e6f906bbd8b165d5dcbea1786b84504782075b7e1ed3d601364fe7c85807d99e4cd7070dfc44c3e96956a73c511cb8c48f26941a64ad86dc7
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXE:7wqd87VE

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
620	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 620	3760	rundll32.exe	93
PID 3760 wrote to memory of 620	3760	rundll32.exe	93
PID 3760 wrote to memory of 620	3760	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5554fff43d58d9d93e0138fab2ee34dc48247374a7fcca34a07fbb32a8eed1dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5554fff43d58d9d93e0138fab2ee34dc48247374a7fcca34a07fbb32a8eed1dc.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3360 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:8
1⤵
PID:2344