74336372ad14cbf6f7def33e0bbe329a35c87a0dcd3bb00ce50accdfd7124dc6

Analysis

max time kernel
153s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 11:21

Target
74336372ad14cbf6f7def33e0bbe329a35c87a0dcd3bb00ce50accdfd7124dc6.dll
Size 51KB
Sample240421-ngc7eahg46
SHA256 74336372ad14cbf6f7def33e0bbe329a35c87a0dcd3bb00ce50accdfd7124dc6
MD5 4764f8bab108008cd69b1bdf02b3f811
SHA1 8307b204c27f7743d7b6a9f011ce4c94ca9b5dca
SHA512 816fe4e8478aadf847fb74f46df1a789706d2daeccb57da6cbad97fd3c65f01b5d1584ccbbf6d2503d21d53c0ff974a341595d5300da6536cecd29d98d1d48ba
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLUJYH5:1dWubF3n9S91BF3fboQJYH5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2696	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 2696	3620	rundll32.exe	90
PID 3620 wrote to memory of 2696	3620	rundll32.exe	90
PID 3620 wrote to memory of 2696	3620	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74336372ad14cbf6f7def33e0bbe329a35c87a0dcd3bb00ce50accdfd7124dc6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74336372ad14cbf6f7def33e0bbe329a35c87a0dcd3bb00ce50accdfd7124dc6.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:2352