4d578592304baa083bcfd61e0970573bf59417c96c318f526fe45745bc9045ab

Analysis

max time kernel
148s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 01:32

Target

4d578592304baa083bcfd61e0970573bf59417c96c318f526fe45745bc9045ab.dll
Size

899KB
MD5

0b7078a5bf1f0a15c36fbe834223996a
SHA1

aa940d9769d254ed2a828ce87bc5ec1d6a6c1a20
SHA256

4d578592304baa083bcfd61e0970573bf59417c96c318f526fe45745bc9045ab
SHA512

1e09db6b73925bc6b6e3eb21fecb957b2ba136313c64d145f3ffb40441a8f4a2ce8dc05bbdc1a1a67e058bc6b82a06ab5261a8ec9de9f78bf5b25f46c797df15
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXI:7wqd87VI

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2196	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 2196	3372	rundll32.exe	91
PID 3372 wrote to memory of 2196	3372	rundll32.exe	91
PID 3372 wrote to memory of 2196	3372	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d578592304baa083bcfd61e0970573bf59417c96c318f526fe45745bc9045ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d578592304baa083bcfd61e0970573bf59417c96c318f526fe45745bc9045ab.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:4472