96befdf0e9a5a7321e00c0a4e28540256ddf82b85e6d67856ebd678323821985

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 22:17

Target

96befdf0e9a5a7321e00c0a4e28540256ddf82b85e6d67856ebd678323821985.dll
Size

899KB
MD5

b97d37c6de86004c348068de33b34850
SHA1

f838047c9575608df3379434a155af5d074a38b9
SHA256

96befdf0e9a5a7321e00c0a4e28540256ddf82b85e6d67856ebd678323821985
SHA512

16eeb43d3f5cb52639afae45557592a9fd014299968b0c0f9597ab1f4d36c5c7366e24c5f28c39563d665d7802e87b8228488321e2bfc819113ed28d7a0425e2
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXi:7wqd87Vi

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4436	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 4436	2828	rundll32.exe	90
PID 2828 wrote to memory of 4436	2828	rundll32.exe	90
PID 2828 wrote to memory of 4436	2828	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96befdf0e9a5a7321e00c0a4e28540256ddf82b85e6d67856ebd678323821985.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96befdf0e9a5a7321e00c0a4e28540256ddf82b85e6d67856ebd678323821985.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:4580