ab8b6d998bb163c5253deee68f3fe5a36a47ea3436bcb58c54e6365d7abe6474

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 04:19

Target

ab8b6d998bb163c5253deee68f3fe5a36a47ea3436bcb58c54e6365d7abe6474.dll
Size

50KB
MD5

0b921a745bb3c077984ec5a228bbc87e
SHA1

fd216aabf7b2bec83289c8cf8e750c13ab49e818
SHA256

ab8b6d998bb163c5253deee68f3fe5a36a47ea3436bcb58c54e6365d7abe6474
SHA512

0fc79350b50764a66b3357aca332fff7b2c0cd8f2ed8020738f7dc337c7d6414a199166feb738a6f9b9a73b3787765c9de3cc04d7013eb9635e64ae7072a47d8
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5wJYH:W5ReWjTrW9rNPgYoeJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
812	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 812	4744	rundll32.exe	90
PID 4744 wrote to memory of 812	4744	rundll32.exe	90
PID 4744 wrote to memory of 812	4744	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab8b6d998bb163c5253deee68f3fe5a36a47ea3436bcb58c54e6365d7abe6474.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab8b6d998bb163c5253deee68f3fe5a36a47ea3436bcb58c54e6365d7abe6474.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2200 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:4380