cc2bc3aa5170849469679f0b8f63f09dc644a2517b55ad4545473cfed66de564

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 16:14

Target
cc2bc3aa5170849469679f0b8f63f09dc644a2517b55ad4545473cfed66de564.dll
Size 51KB
Sample240422-tpvz3sdc62
SHA256 cc2bc3aa5170849469679f0b8f63f09dc644a2517b55ad4545473cfed66de564
MD5 ab79a307e4fe0e89769dab500d75d952
SHA1 e436b177c13621c3c5641df693a636e3c32328a7
SHA512 8d5a2d1c6b70571447d409e8ac0a20047e4589789f8571ad9162f49f9283ec2b7e0f8c98a2fe435d9a32be437343f901829f6ec13c88a39871befdba8e2ba6a8
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLFJYH5:1dWubF3n9S91BF3fbopJYH5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3848	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 3848	4000	rundll32.exe	91
PID 4000 wrote to memory of 3848	4000	rundll32.exe	91
PID 4000 wrote to memory of 3848	4000	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc2bc3aa5170849469679f0b8f63f09dc644a2517b55ad4545473cfed66de564.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc2bc3aa5170849469679f0b8f63f09dc644a2517b55ad4545473cfed66de564.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3784 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:2732