3481b8c075e718128fb89afaea97f071deb3bd40cb222c2062693133650dea6a

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 03:32

Target
3481b8c075e718128fb89afaea97f071deb3bd40cb222c2062693133650dea6a.dll
Size 51KB
Sample240423-d3t2yace31
SHA256 3481b8c075e718128fb89afaea97f071deb3bd40cb222c2062693133650dea6a
MD5 da701decbbb91b0559d277a7f8827532
SHA1 3633aeac112f73b97438384a1c7009bccb61c09f
SHA512 0e1d32525ae96d2a5317feabc7e3260063201930399e207e17e542b74ccdd5c31257b28801314abf00f6c6dd4fd19cc8dbb498ff21356745fced73a66076ca3a
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLvJYH5:1dWubF3n9S91BF3fborJYH5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5048	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 5048	1076	rundll32.exe	91
PID 1076 wrote to memory of 5048	1076	rundll32.exe	91
PID 1076 wrote to memory of 5048	1076	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3481b8c075e718128fb89afaea97f071deb3bd40cb222c2062693133650dea6a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3481b8c075e718128fb89afaea97f071deb3bd40cb222c2062693133650dea6a.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:1008