Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 02:53
Behavioral task
behavioral1
Sample
54bf90b49137d83d727306f5396c540faecd28bc44b4423470e9b7619da566ca.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
54bf90b49137d83d727306f5396c540faecd28bc44b4423470e9b7619da566ca.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
54bf90b49137d83d727306f5396c540faecd28bc44b4423470e9b7619da566ca.dll
-
Size
51KB
-
MD5
04f72caadf9b6222f6d449a1537622b2
-
SHA1
032799f5afc52daf078aa8e2581f3778f47b3cd2
-
SHA256
54bf90b49137d83d727306f5396c540faecd28bc44b4423470e9b7619da566ca
-
SHA512
770ac82f2fba609322b5f44988a286e794f2e731634ccfe74adbc5ee7a7eba9308e9e79c0562f6946e0c18bbc18c3c4634d78925b41eb002fa1fbd256081e96c
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLTJYH5:1dWubF3n9S91BF3fboXJYH5
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4176 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1960 wrote to memory of 4176 1960 rundll32.exe 91 PID 1960 wrote to memory of 4176 1960 rundll32.exe 91 PID 1960 wrote to memory of 4176 1960 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\54bf90b49137d83d727306f5396c540faecd28bc44b4423470e9b7619da566ca.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\54bf90b49137d83d727306f5396c540faecd28bc44b4423470e9b7619da566ca.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵PID:1824