a3aaabc35d710dc0e559501bfe1341f077ce9e41794d70ecf5ac4b9dc9391f66

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 14:14

Target

a3aaabc35d710dc0e559501bfe1341f077ce9e41794d70ecf5ac4b9dc9391f66.dll
Size

50KB
MD5

46d932884b50817a44e92ff222bf4c0a
SHA1

e27c45511499bbfa2fc2e9de7bfdb69cc6ddaeea
SHA256

a3aaabc35d710dc0e559501bfe1341f077ce9e41794d70ecf5ac4b9dc9391f66
SHA512

58383920c7e67ea6fc48376bd4aa1c9f77e424612e9c94c146f9b3afec2b92ee93aa1dce85337b91e30e52be01e66a589b1f087f43d3c75aebccc6915072c57b
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o59JYH:W5ReWjTrW9rNPgYoPJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4812	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 4812	1904	rundll32.exe	90
PID 1904 wrote to memory of 4812	1904	rundll32.exe	90
PID 1904 wrote to memory of 4812	1904	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3aaabc35d710dc0e559501bfe1341f077ce9e41794d70ecf5ac4b9dc9391f66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3aaabc35d710dc0e559501bfe1341f077ce9e41794d70ecf5ac4b9dc9391f66.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:1168