Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 02:35
Behavioral task
behavioral1
Sample
2a05181684cc231ba7745febd6adacd43f2e67d52406591dddfb9cdd4415f113.dll
Resource
win7-20240215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2a05181684cc231ba7745febd6adacd43f2e67d52406591dddfb9cdd4415f113.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2a05181684cc231ba7745febd6adacd43f2e67d52406591dddfb9cdd4415f113.dll
-
Size
51KB
-
MD5
a30d9aa270dc2faf11d0f0f4539380c2
-
SHA1
74bfe8821f0b3f92d76228ba0a1b813d69d67bc8
-
SHA256
2a05181684cc231ba7745febd6adacd43f2e67d52406591dddfb9cdd4415f113
-
SHA512
1d2ff107164e852e6434dce05d6ff8b1972cbc8559ddea2936434dbc50b9fdbe068317cb0520a0410505673655d0d0bc6ddbe5c8898ac6d755e43415725b4378
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL2JYH5:1dWubF3n9S91BF3fboiJYH5
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 392 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2320 wrote to memory of 392 2320 rundll32.exe 92 PID 2320 wrote to memory of 392 2320 rundll32.exe 92 PID 2320 wrote to memory of 392 2320 rundll32.exe 92
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a05181684cc231ba7745febd6adacd43f2e67d52406591dddfb9cdd4415f113.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a05181684cc231ba7745febd6adacd43f2e67d52406591dddfb9cdd4415f113.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2824 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:81⤵PID:4908