9abc5c3eb8255433488dd62e327a6650bae2980837a6952bafb510cf89dae178

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 00:38

Target

9abc5c3eb8255433488dd62e327a6650bae2980837a6952bafb510cf89dae178.dll
Size

51KB
MD5

6b95d4a1ccc3961fb84b95c21643fa81
SHA1

71fd63fa4a7862841924f1cd9a88fb9abaf79538
SHA256

9abc5c3eb8255433488dd62e327a6650bae2980837a6952bafb510cf89dae178
SHA512

9a62407c0a5ff92620a7c8167fb0ba4292c4019acaa3bb7534a592a5d92e08d6358ce406eacec69ed95cdcbe032752c4f4a0c1cb3949644088a22ef0428022c4
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL9JYH5:1dWubF3n9S91BF3fboxJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5004	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 5004	412	rundll32.exe	90
PID 412 wrote to memory of 5004	412	rundll32.exe	90
PID 412 wrote to memory of 5004	412	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9abc5c3eb8255433488dd62e327a6650bae2980837a6952bafb510cf89dae178.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9abc5c3eb8255433488dd62e327a6650bae2980837a6952bafb510cf89dae178.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:640