54bf90b49137d83d727306f5396c540faecd28bc44b4423470e9b7619da566ca

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 02:53

Target
54bf90b49137d83d727306f5396c540faecd28bc44b4423470e9b7619da566ca.dll
Size 51KB
Sample240423-dde7gsca35
SHA256 54bf90b49137d83d727306f5396c540faecd28bc44b4423470e9b7619da566ca
MD5 04f72caadf9b6222f6d449a1537622b2
SHA1 032799f5afc52daf078aa8e2581f3778f47b3cd2
SHA512 770ac82f2fba609322b5f44988a286e794f2e731634ccfe74adbc5ee7a7eba9308e9e79c0562f6946e0c18bbc18c3c4634d78925b41eb002fa1fbd256081e96c
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLTJYH5:1dWubF3n9S91BF3fboXJYH5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4176	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 4176	1960	rundll32.exe	91
PID 1960 wrote to memory of 4176	1960	rundll32.exe	91
PID 1960 wrote to memory of 4176	1960	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54bf90b49137d83d727306f5396c540faecd28bc44b4423470e9b7619da566ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\54bf90b49137d83d727306f5396c540faecd28bc44b4423470e9b7619da566ca.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:1824