ca08ed3ff05f3da324cca05f96466c4220f063e48d1a423f206cb40de711072d

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 18:37

Target

ca08ed3ff05f3da324cca05f96466c4220f063e48d1a423f206cb40de711072d.dll
Size

899KB
MD5

d0213f2e63a03d05d942afeac2ec7d2e
SHA1

fcabcc236fd0246e569e5eba5ccc62cc637b0c5b
SHA256

ca08ed3ff05f3da324cca05f96466c4220f063e48d1a423f206cb40de711072d
SHA512

9f8657e1c37bb14e65420ac9deb4771723f93064b36d0bd3b96c6f91effcccc5d4b57ed35e63f9cea29560f9f381bb82e7c8e2e165291389cf715a7c2e67d06a
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXj:7wqd87Vj

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3800	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 3800	1804	rundll32.exe	92
PID 1804 wrote to memory of 3800	1804	rundll32.exe	92
PID 1804 wrote to memory of 3800	1804	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca08ed3ff05f3da324cca05f96466c4220f063e48d1a423f206cb40de711072d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca08ed3ff05f3da324cca05f96466c4220f063e48d1a423f206cb40de711072d.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3944 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:1372