792d0762ad4249fb09f63d781f8e1ad506ce1b55d93c9e7cec1f628fc55c6145

Analysis

max time kernel
139s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 20:49

Target

CoinBase Checker/CoinBase Checker/libeay32.dll
Size

988KB
MD5

177bda0c92482dfa2c162a3750932b9c
SHA1

cb3b8a465fb55e9e0b4bb5a3298a481557a799d5
SHA256

17a4b75ef43a4fdeedaef86c39bead6719144e3e368b55898b79ecb371012854
SHA512

d6900cbcd53d2993ea639e70fe7d0b29595153c4ef54eb9c4a264c22963ca64d551dd633ce1c5d657bd371ddeebcff00419d50a13e423d44f25c8ac9f8ccf3d0
SSDEEP

12288:baTkV9YfAjvnC+pcU0MfHJQXA7WpVn2UNKQbox5b6j6iHk:bOBcnJpcTMve5pV9sQbsejrHk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 1612	4740	rundll32.exe	94
PID 4740 wrote to memory of 1612	4740	rundll32.exe	94
PID 4740 wrote to memory of 1612	4740	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CoinBase Checker\CoinBase Checker\libeay32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CoinBase Checker\CoinBase Checker\libeay32.dll",#1
  2⤵
  PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:4428