86359584d794f37c3f2442b3062cfc07578a0dec81323368613e03a3964392a7

Analysis

max time kernel
144s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 19:27

Target

cc3b29be8ae014b5d735871cd316c403.dll
Size

16KB
MD5

cc3b29be8ae014b5d735871cd316c403
SHA1

9f607cf3bacb7a842ffef2230f66e44cdbcb8c7b
SHA256

86359584d794f37c3f2442b3062cfc07578a0dec81323368613e03a3964392a7
SHA512

1ed90996e6ce86ff564492e8d8f3e5884d99bd357ff11d5ff5607a5717981dbced295ea09d3884fa69bc57d5b4ef4a6ef842b2bbb6e78a69f6cb3f7aef4a9122
SSDEEP

192:Dbm+GtNKYnvN6fT/AGSrQluVCc0QhapTiXShV2OSvfe:DqdKSV6fTMrQQV10AapJVvSn

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
672	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2132	2972	rundll32.exe	96
PID 2972 wrote to memory of 2132	2972	rundll32.exe	96
PID 2972 wrote to memory of 2132	2972	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc3b29be8ae014b5d735871cd316c403.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc3b29be8ae014b5d735871cd316c403.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4192 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:2560