6f7c4ba64fcaa51e7d1c5b5abedd37add753c65ab48d07b3c08109a6bf5121dd

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 17:23

Target

6f7c4ba64fcaa51e7d1c5b5abedd37add753c65ab48d07b3c08109a6bf5121dd.dll
Size

51KB
MD5

7c54b4f7dabb2b63bae3ffb7713d579d
SHA1

bae3eb5375bf4f4e1059a6f17353c801cbde66e4
SHA256

6f7c4ba64fcaa51e7d1c5b5abedd37add753c65ab48d07b3c08109a6bf5121dd
SHA512

d184690bcf7c6dd2ce1ca04c0a61548c673fd40a5b99ba550fd647ee908c0d90276f9b6e92ab08513351471500d276f37532ce81b3f6aa2cefdfeab0f1bcc9cb
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL0JYH5:1dWubF3n9S91BF3fbo4JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5072	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 5072	1072	rundll32.exe	91
PID 1072 wrote to memory of 5072	1072	rundll32.exe	91
PID 1072 wrote to memory of 5072	1072	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f7c4ba64fcaa51e7d1c5b5abedd37add753c65ab48d07b3c08109a6bf5121dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f7c4ba64fcaa51e7d1c5b5abedd37add753c65ab48d07b3c08109a6bf5121dd.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:832