f8520feff0e7a9b2bf7cf0d44b64a9134ea047903c69d68e4c2924e4ae34f6e1

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 11:18

Target
f8520feff0e7a9b2bf7cf0d44b64a9134ea047903c69d68e4c2924e4ae34f6e1.dll
Size 899KB
Sample240421-nesjbahf87
SHA256 f8520feff0e7a9b2bf7cf0d44b64a9134ea047903c69d68e4c2924e4ae34f6e1
MD5 2e70e5c909669c234fe2b947140d0ca4
SHA1 6a4fa72d1fa0b0003804509a32e0fe36132b1c38
SHA512 7dc0e669e36a4300c22a80a1fccf0430606243e3032c345a558f4a1b92ece887d4738f91f1d06d155aa0b38c2f271d1f4a860d1839622027dea44d561afc532f
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXo:7wqd87Vo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2156	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2156	5076	rundll32.exe	91
PID 5076 wrote to memory of 2156	5076	rundll32.exe	91
PID 5076 wrote to memory of 2156	5076	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8520feff0e7a9b2bf7cf0d44b64a9134ea047903c69d68e4c2924e4ae34f6e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8520feff0e7a9b2bf7cf0d44b64a9134ea047903c69d68e4c2924e4ae34f6e1.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:904