5d4bf7c7c2d30d8c97a6d8c8f8dc6b17dc67db5eff4031b9a3dc5b882a11912a

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 01:19

Target

5d4bf7c7c2d30d8c97a6d8c8f8dc6b17dc67db5eff4031b9a3dc5b882a11912a.dll
Size

899KB
MD5

4860a053401528f56872e03de3638d06
SHA1

6491927c4e7ef9e38db116d572466e8832100eee
SHA256

5d4bf7c7c2d30d8c97a6d8c8f8dc6b17dc67db5eff4031b9a3dc5b882a11912a
SHA512

614010686f0345736071fd694bcfb76555a4dfefb187e662917df061f93125e5ff9eb2ce7a5c1db4264fa6988fa64b464e7f7acf8de48c7493fd7ef60703e303
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXQ:7wqd87VQ

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4660	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4660	1496	rundll32.exe	89
PID 1496 wrote to memory of 4660	1496	rundll32.exe	89
PID 1496 wrote to memory of 4660	1496	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d4bf7c7c2d30d8c97a6d8c8f8dc6b17dc67db5eff4031b9a3dc5b882a11912a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d4bf7c7c2d30d8c97a6d8c8f8dc6b17dc67db5eff4031b9a3dc5b882a11912a.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:2512