541806f164e3c6b21cbda2b5e5816e908d5241990c4b4504f96e056f2c7650b7

Analysis

max time kernel
164s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 19:02

Target

541806f164e3c6b21cbda2b5e5816e908d5241990c4b4504f96e056f2c7650b7.dll
Size

899KB
MD5

5728f78c1f232816fcef9f0657939df7
SHA1

4c20e89bffe6265e60c4adbce01dc77521474dfc
SHA256

541806f164e3c6b21cbda2b5e5816e908d5241990c4b4504f96e056f2c7650b7
SHA512

37cdcd3962d520fd811c4d9ca7de13b0626ebf72193d11600aee72f15572d45f0041b738f594520150855536360e75d533c02dc85062de4198c44fe7b57563b3
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXn:7wqd87Vn

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1424	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 1424	3568	rundll32.exe	96
PID 3568 wrote to memory of 1424	3568	rundll32.exe	96
PID 3568 wrote to memory of 1424	3568	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\541806f164e3c6b21cbda2b5e5816e908d5241990c4b4504f96e056f2c7650b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\541806f164e3c6b21cbda2b5e5816e908d5241990c4b4504f96e056f2c7650b7.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:1800