d78fe2a6524e9dac5fb7ecdabe8ad993d95c1ac42d8980dafb14863f0a3c4c67

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 18:01

Target

d78fe2a6524e9dac5fb7ecdabe8ad993d95c1ac42d8980dafb14863f0a3c4c67.dll
Size

51KB
MD5

c3564e225dca92c4fd90fdc60da093e2
SHA1

188415d32ad891fbc9baeb5b6900d1f10b2df152
SHA256

d78fe2a6524e9dac5fb7ecdabe8ad993d95c1ac42d8980dafb14863f0a3c4c67
SHA512

62b709a58b944ede5b16a8f5062b0c4122734b3a3583494c37357fa28ca2f7bd45d9035e570ad81c2f152879bbdfbd67a7a13475c584ca905e23846aca530528
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLtJYH5:1dWubF3n9S91BF3fboZJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4316	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 4316	892	rundll32.exe	91
PID 892 wrote to memory of 4316	892	rundll32.exe	91
PID 892 wrote to memory of 4316	892	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d78fe2a6524e9dac5fb7ecdabe8ad993d95c1ac42d8980dafb14863f0a3c4c67.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d78fe2a6524e9dac5fb7ecdabe8ad993d95c1ac42d8980dafb14863f0a3c4c67.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:1400