c94d8063e97908ac2e73439cb0ded15e49a7f2ad26eedf2f7e840c9b417579ac

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 22:18

Target

c94d8063e97908ac2e73439cb0ded15e49a7f2ad26eedf2f7e840c9b417579ac.dll
Size

51KB
MD5

7928cbe5e4c973444706ee435003d087
SHA1

c25220fea87847a4a6f5962ea5e3da7d35999340
SHA256

c94d8063e97908ac2e73439cb0ded15e49a7f2ad26eedf2f7e840c9b417579ac
SHA512

1284aa821497c2d798b43b7ad20d6182084f76fb56b497c676d44082b0a7e7091b7f819073247c7c3cfdc7d84dc188b7ea18df609e303c8657bb9622179ef70f
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL5JYH5:1dWubF3n9S91BF3fboNJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3800	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 3800	824	rundll32.exe	90
PID 824 wrote to memory of 3800	824	rundll32.exe	90
PID 824 wrote to memory of 3800	824	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c94d8063e97908ac2e73439cb0ded15e49a7f2ad26eedf2f7e840c9b417579ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c94d8063e97908ac2e73439cb0ded15e49a7f2ad26eedf2f7e840c9b417579ac.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3944 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:964