Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 02:51
Behavioral task
behavioral1
Sample
861c5199148ead6b38adc6b8b596ccd9c4752095121094ffe1d1ad21d701f05d.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
861c5199148ead6b38adc6b8b596ccd9c4752095121094ffe1d1ad21d701f05d.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
861c5199148ead6b38adc6b8b596ccd9c4752095121094ffe1d1ad21d701f05d.dll
-
Size
899KB
-
MD5
89a524e7cf2c4c9ff6761e60f5a780b9
-
SHA1
0a92e231635e55086497fb8adb967feabce7467d
-
SHA256
861c5199148ead6b38adc6b8b596ccd9c4752095121094ffe1d1ad21d701f05d
-
SHA512
8abc0582421595799c77c86dd7a9693d581f6bc418101e7c781bfa84a217bc901187999cf9d289a912acfe06d789efd5c1ef9daeb29cb4270c85302bf2330f63
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXs:7wqd87Vs
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4068 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1152 wrote to memory of 4068 1152 rundll32.exe 89 PID 1152 wrote to memory of 4068 1152 rundll32.exe 89 PID 1152 wrote to memory of 4068 1152 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\861c5199148ead6b38adc6b8b596ccd9c4752095121094ffe1d1ad21d701f05d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\861c5199148ead6b38adc6b8b596ccd9c4752095121094ffe1d1ad21d701f05d.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵PID:832