c3b50efd8742ef4bfb0a4ef9965aca0f227564ce25b898fd5f88805135008d1b

Analysis

max time kernel
138s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 02:13

Target
c3b50efd8742ef4bfb0a4ef9965aca0f227564ce25b898fd5f88805135008d1b.dll
Size 899KB
Sample240418-cnj3ragd88
SHA256 c3b50efd8742ef4bfb0a4ef9965aca0f227564ce25b898fd5f88805135008d1b
MD5 e28afdeb508215e23dfac9a295c2da6a
SHA1 9193c8e152c2b0e935fdf3852398e77d1ea1adc4
SHA512 6d185ae9e49e6f700e5d12369a58653e3b0f2e9e3952e7796f25e7be8caabaeacc38b3628e9ea9111599cc2ccf931af043cdb6a6b23ef831b11b1106d7d7461b
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXX:7wqd87VX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4808	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4808	4616	rundll32.exe	89
PID 4616 wrote to memory of 4808	4616	rundll32.exe	89
PID 4616 wrote to memory of 4808	4616	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3b50efd8742ef4bfb0a4ef9965aca0f227564ce25b898fd5f88805135008d1b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3b50efd8742ef4bfb0a4ef9965aca0f227564ce25b898fd5f88805135008d1b.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3780,i,107393453197044369,3794435770200482906,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:8
1⤵
PID:680