05dbc024c48458e54016027bf4d55af3ee4912fce1f3b28cb0e0a93cf901da50

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 04:02

Target

05dbc024c48458e54016027bf4d55af3ee4912fce1f3b28cb0e0a93cf901da50.dll
Size

51KB
MD5

51b3c848673f618edc75e042fc5fe230
SHA1

06ffb0e973be9a7d45c5c00add50a7f8910b4b2d
SHA256

05dbc024c48458e54016027bf4d55af3ee4912fce1f3b28cb0e0a93cf901da50
SHA512

23001c21f3e8cb07bde05e3376adaf4ad6a5c0244dc7ecd0fd7b7958cd8a65de4d65038cee971c3392965a0c08bcc3bf9f28f8bf08b81110ea755f62754a14e4
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL/JYH5:1dWubF3n9S91BF3fbojJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3640	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 3640	864	rundll32.exe	89
PID 864 wrote to memory of 3640	864	rundll32.exe	89
PID 864 wrote to memory of 3640	864	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05dbc024c48458e54016027bf4d55af3ee4912fce1f3b28cb0e0a93cf901da50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05dbc024c48458e54016027bf4d55af3ee4912fce1f3b28cb0e0a93cf901da50.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1428 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:1284