bfb2483c554948dd16d989e1ee54650aa3d612fc43c8b82cc7399c112d330579

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 07:22

Target

bfb2483c554948dd16d989e1ee54650aa3d612fc43c8b82cc7399c112d330579.dll
Size

899KB
MD5

10e9df628613ff19aa22ea7fac6f455c
SHA1

882b97f116fd5a5571e247c0cfd6b88a47699e04
SHA256

bfb2483c554948dd16d989e1ee54650aa3d612fc43c8b82cc7399c112d330579
SHA512

5aa241afe79322195a2e2be65a04a2261f693d8121418ec34c0d9b39d80c01259f2d676d6c7b9944916c98eeeb6b2b0ff3e8c4adff04c44700de0c16729e11e6
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXT:7wqd87VT

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3460	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3460	4656	rundll32.exe	91
PID 4656 wrote to memory of 3460	4656	rundll32.exe	91
PID 4656 wrote to memory of 3460	4656	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfb2483c554948dd16d989e1ee54650aa3d612fc43c8b82cc7399c112d330579.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfb2483c554948dd16d989e1ee54650aa3d612fc43c8b82cc7399c112d330579.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3312