Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 02:51
Behavioral task
behavioral1
Sample
b961d99a3ca8dd8559b35fdf8c52a971a0966670567aefc1be1c261dc98beb78.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
b961d99a3ca8dd8559b35fdf8c52a971a0966670567aefc1be1c261dc98beb78.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
b961d99a3ca8dd8559b35fdf8c52a971a0966670567aefc1be1c261dc98beb78.dll
-
Size
899KB
-
MD5
e6b7bc9e1aa1a0f1d7a1efee354e6145
-
SHA1
7661fdbe6005eaffc1d88ce3288210b9b26a852c
-
SHA256
b961d99a3ca8dd8559b35fdf8c52a971a0966670567aefc1be1c261dc98beb78
-
SHA512
63e204f5a79d6a4da0fca59f21824e3e12ece8d9bce96ecf13530a544187e5dff5edbf5bab0be6cc934da6da66f96ce1370ba3c6d3e59b83d08df1bd3c3b2c44
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX7:7wqd87V7
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4148 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1348 wrote to memory of 4148 1348 rundll32.exe 91 PID 1348 wrote to memory of 4148 1348 rundll32.exe 91 PID 1348 wrote to memory of 4148 1348 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b961d99a3ca8dd8559b35fdf8c52a971a0966670567aefc1be1c261dc98beb78.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b961d99a3ca8dd8559b35fdf8c52a971a0966670567aefc1be1c261dc98beb78.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:5084