259b56d0561294b66903198861c300206f14821367e712f95e5581d512468207

Analysis

max time kernel
138s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 18:04

Target

259b56d0561294b66903198861c300206f14821367e712f95e5581d512468207.dll
Size

899KB
MD5

2a4d75829f1138d1f975949ede03b0ba
SHA1

da3b77fe8b2eac49e5f94d29e3a4217655ef3f62
SHA256

259b56d0561294b66903198861c300206f14821367e712f95e5581d512468207
SHA512

8d00c7da73fde7444c1cd91dcfa62407d2f78e74b2ccad5de0e4e2fba15c30c9d9ff61ae3fff2486074e12b9284b7a097f94673c87dc5a3f1582cac3e242511a
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX8:7wqd87V8

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3240	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3240	4516	rundll32.exe	89
PID 4516 wrote to memory of 3240	4516	rundll32.exe	89
PID 4516 wrote to memory of 3240	4516	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\259b56d0561294b66903198861c300206f14821367e712f95e5581d512468207.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\259b56d0561294b66903198861c300206f14821367e712f95e5581d512468207.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4152,i,17229298512878960157,13441031190071685883,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
1⤵
PID:3988