53a8adc4abee09744bf4e7ebd713a651018240dad85cf4f76904c3c1f5a0d35d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 19:15

Target

53a8adc4abee09744bf4e7ebd713a651018240dad85cf4f76904c3c1f5a0d35d.dll
Size

899KB
MD5

4a20420383589eaa4f5791010137cb87
SHA1

553f7b299042fee125da7877005180771c1bccde
SHA256

53a8adc4abee09744bf4e7ebd713a651018240dad85cf4f76904c3c1f5a0d35d
SHA512

1f2ced551117c2c4b2462516f52be0b83bbaeb7e59fa88847087378102068eb994ca356ad21a572e880c82916c080080b2eb030b4d4037074487a84a187a6a51
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXt:7wqd87Vt

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2208	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 2208	3844	rundll32.exe	90
PID 3844 wrote to memory of 2208	3844	rundll32.exe	90
PID 3844 wrote to memory of 2208	3844	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53a8adc4abee09744bf4e7ebd713a651018240dad85cf4f76904c3c1f5a0d35d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\53a8adc4abee09744bf4e7ebd713a651018240dad85cf4f76904c3c1f5a0d35d.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3896 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:2256