5baee55663a6ccc67551c2cb01758488ed9b0d26d1e7b57e1e9cdb46f10428e5

Analysis

max time kernel
137s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 20:39

Target

5baee55663a6ccc67551c2cb01758488ed9b0d26d1e7b57e1e9cdb46f10428e5.dll
Size

51KB
MD5

63f437ea611bebccee5c72e8c2795c8d
SHA1

46d9ae6b456fa4d9a37d933a18964e38375a4ce6
SHA256

5baee55663a6ccc67551c2cb01758488ed9b0d26d1e7b57e1e9cdb46f10428e5
SHA512

6c0780cae665675c6176600c21734d0355cf92f5f536cad84c56f0aa8311d1a4a216288cbdacca5c2409b845b809c26f55938e4e1d392493e21a1a80ba6e0baa
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLCJYH5:1dWubF3n9S91BF3fboeJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1576	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 1576	4344	rundll32.exe	92
PID 4344 wrote to memory of 1576	4344	rundll32.exe	92
PID 4344 wrote to memory of 1576	4344	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5baee55663a6ccc67551c2cb01758488ed9b0d26d1e7b57e1e9cdb46f10428e5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5baee55663a6ccc67551c2cb01758488ed9b0d26d1e7b57e1e9cdb46f10428e5.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4120,i,7064649017625232947,17746804975634116675,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
1⤵
PID:2696