16e5e829bedd660ace720b5970ae6a8aa84c354f85e6ed3c012df44fdb065c28

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 23:10

Target

16e5e829bedd660ace720b5970ae6a8aa84c354f85e6ed3c012df44fdb065c28.dll
Size

899KB
MD5

b0b288d5e3575706eca701a1b3519334
SHA1

cf67878866ac32ca723ff12ed56ece74b5f31a3d
SHA256

16e5e829bedd660ace720b5970ae6a8aa84c354f85e6ed3c012df44fdb065c28
SHA512

a50d339552a036c4ce3ffacd78b7167e5f61d70de02df0d9a577ee752fe187b7071258569cbda1550631f9697d2c96bc89ca73f96141d9f871d0d119f307403b
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX/:7wqd87V/

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4856	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 4856	536	rundll32.exe	91
PID 536 wrote to memory of 4856	536	rundll32.exe	91
PID 536 wrote to memory of 4856	536	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16e5e829bedd660ace720b5970ae6a8aa84c354f85e6ed3c012df44fdb065c28.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16e5e829bedd660ace720b5970ae6a8aa84c354f85e6ed3c012df44fdb065c28.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:3416