1921c8e44ac16a8c947f082088d08871eaf63cf1ddfa6aa866b8750b856b985b

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 05:32

Target

1921c8e44ac16a8c947f082088d08871eaf63cf1ddfa6aa866b8750b856b985b.dll
Size

50KB
MD5

c9cfcd6e5eec626b80d16421f46e73f1
SHA1

8cf0bfe6e9d64987fdd04863882968e2f291d1ef
SHA256

1921c8e44ac16a8c947f082088d08871eaf63cf1ddfa6aa866b8750b856b985b
SHA512

5b6925313843132db3826d1885e46de5b9c8a9999886a3a9bdf5d4e1e192b1f7c4d04ab098b1048bac42f6efb52294abac0a072b2e84ca3a8b94be3867fbc724
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5hJYH:W5ReWjTrW9rNPgYo3JYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4644	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 4644	3248	rundll32.exe	91
PID 3248 wrote to memory of 4644	3248	rundll32.exe	91
PID 3248 wrote to memory of 4644	3248	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1921c8e44ac16a8c947f082088d08871eaf63cf1ddfa6aa866b8750b856b985b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1921c8e44ac16a8c947f082088d08871eaf63cf1ddfa6aa866b8750b856b985b.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:4900